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Technical Assessment Report 
1.0 Notification and Authorization 

The NASA Engineering and Safety Center (NESC) received a request to support the Assessment 
of the International Space Station (ISS) Plasma Contactor Unit (PCU) Utilization Update. This 
assessment was co-led by Dr. Christopher Iannello, NASA Technical Fellow for Electrical 
Power, and Ms. Amri Hernandez -Pellerano, NASA Electrical Power Technical Discipline Team 
(TDT) member. The NESC conducted an earlier assessment of the use of the PCU in 2009 
(NESC Request #07-054-E 1 ) [NASA, 2009]. The objective for that assessment was to evaluate 
whether leaving PCUs off during non-extravehicular activity (EVA) time frames presented any 
risk to the ISS through assembly completion. Dr. Steven Koontz asked the previous assessment 
be extended to include the following possible additions to the PCU utilization plan: 

- Nominally leaving the PCUs off during EVA if pre-EVA hazard severity 
measurements and short-term ionospheric environment forecasts support that 
decision. 

- Disabling the EVA shunt fault detection, isolation and recovery (FDIR) logic and the 
supporting operational hazard controls if two PCUs are in discharge during the EVA. 

- Possible long-term marginalization of the ISS EVA-3 12 shock hazard report so that 
no active hazard controls are required. 

The key stakeholders for this assessment were Dr. Steven Koontz and the ISS Program (ISSP). 


1 NESC-RP-07-054/NASA/TM-20 10-216683 
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4.0 Executive Summary 

The International Space Station (ISS) vehicle undergoes spacecraft charging as it interacts with 
Earth’s ionosphere and magnetic field. The interaction can result in a large potential difference 
developing between the ISS metal chassis and the local ionosphere plasma environment. If an 
astronaut conducting extravehicular activities (EVA) is exposed to the potential difference, then 
a possible electrical shock hazard arises. 

The control of this hazard was addressed by a number of documents within the ISS Program 
(ISSP) including Catastrophic Safety Hazard for Astronauts on EVA (ISS-EVA-3 12-4A_revE). 
The safety hazard identified the risk for an astronaut to experience an electrical shock in the 
event an arc was generated on an extravehicular mobility unit (EMU) surface. A catastrophic 
safety hazard, by the ISS requirements, necessitates mitigation by a two-fault tolerant system of 
hazard controls. Traditionally, the plasma contactor units (PCUs) on the ISS have been used to 
limit the charging and serve as a “ground strap” between the ISS structure and the surrounding 
ionospheric plasma. 

In 2009, a previous NASA Engineering and Safety Center (NESC) team evaluated the PCU 
utilization plan (NESC Request #07-054-E) with the objective to assess whether leaving PCUs 
off during non-EVA time periods presented risk to the ISS through assembly completion. For 
this study, in situ measurements of ISS charging, covering the installation of three of the four 
photovoltaic arrays, and laboratory testing results provided key data to underpin the assessment. 
The conclusion stated, “ there appears to be no significant risk of damage to critical equipment 
nor excessive ISS thermal coating damage as a result of eliminating PCU operations during non- 
EVA times. ” 

In 2013, the ISSP was presented with recommendations from Boeing Space Environments for 
the “Conditional” Marginalization of Plasma Hazard [Mikatarian, R., et ah, 2013]. These 
recommendations include a plan that would keep the PCUs off during EVAs when the space 
environment forecast input to the ISS charging model indicates floating potentials (FP) within 
specified limits. These recommendations were based on the persistence of conditions in the 
space environment due to the current low solar cycle and belief in the accuracy and completeness 
of the ISS charging model. Subsequently, a Noncompliance Report (NCR), ISS-NCR-232G, 
Lack of Two-fault Tolerance to EVA Crew Shock in the Low Earth Orbit Plasma Environment, 
was signed in September 2013 specifying new guidelines for the use of shock hazard controls 
based on a forecast of the space environment from ISS plasma measurements taken prior to the 
EVA [ISS-EVA-3 12-AC, 2012]. 

This NESC assessment re-evaluates EVA charging hazards through a process that is based on 
over 14 years of ISS operations, charging measurements, laboratory tests, EMU studies and 
modifications, and safety reports. The assessment seeks an objective review of the plasma 
charging hazards associated with EVA operations to determine if any of the present hazard 
controls can safely change the PCU utilization plan to allow more flexibility in ISS operations 
during EVA preparation and execution. 


NESC Request No.: TI-13-00869 



NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

13-00869 

Version: 

1.0 

Title: 

ISS PCU Utilization Plan Assessment Update 

Page #: 

11 of 225 


The following approach was used: 

1) Review shock hazard-related data as provided in the measurements from the floating 
potential measuring unit (FPMU) aboard the spacecraft and other ISSP sources. 

2) Compare the ISS charging model output versus FPMU measurement. 

3) Review existing ISS documentation related to shock hazards and controls. 

4) Provide preliminary analysis and data observations related to the shock hazard severity, 
available controls, and forecast tool capabilities. 

The NESC recommends continuing the catastrophic hazard assumption and the use of three 
controls for the typical two-fault tolerant hazard control during all EVAs regardless of FP 
predictions or EVA location. These recommendations include the use of the two PCUs in 
discharge for EVAs and propose the ISS/EVA team evaluate the use of the low probability of 
contact (which includes the isolation features in the ISS-suit-crew path) as the third control while 
discontinuing the use of the solar array wing shunt fault detection, isolation and recovery 
(FDIR). In addition, it is recommended that the Plasma Interaction Model version 3 (PIM3.0) 
“predictions” (i.e., forecast) be constrained to planning purposes and not be used to determine 
the use of active hazard controls. Refer to Appendix I for a Summary of Key Points from this 
assessment. 
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5.0 Assessment Plan 

This assessment started with the assembly of a team that included plasma physicists, space 
environment scientists, EVA safety specialists, medical team specialists, system engineers, 
power system engineers, and administrative support. 

The plan was divided (according to the request) into three main re-phrased questions: 

(1) Is it acceptable for PCUs to be off during EVAs? 

(2) Can the FDIR be disabled if two PCUs are in discharge? 

(3) Is it acceptable to conduct an EVA without active shock hazard controls? 

Several key documents and presentations related to the use of controls and environment 
“forecasting” were reviewed to understand the hazard and available controls and guidelines. For 
example, these included the ISS-EVA-312-AC (1/26/2012): Electric Shock to EVA Crew 
Resulting from EMU Arcing in Plasma [ISS-EVA-312-AC, 2012]; the ISS-NCR-232F 
(1/26/2012): Lack of Two-fault Tolerance to EVA Crew Shock in the Low Earth Orbit Plasma 
Environment [ISS-NCR-232F, 2012] and the ISS-NCR-232G (9/2013) [ISS-NCR-232G, 2013]. 
Data from the FPMU, International Reference Ionosphere (IRI), and calculations from the 
PIM3.0 were reviewed to understand the forecast limitations and the types of charging events at 
the ISS. The kn own magnitudes of these charging events and the ISS FP levels were considered 
in the assessment. 

Documents were reviewed and direct communication was established with ISS power 
engineering to understand the FDIR basic functionality. Data related to charging events due to 
shunting or unshunting solar arrays were considered. Alternatives to the use of the FDIR were 
considered based on the shock hazard severity, the likelihood of completing an electrical circuit 
current path, possible conditions affecting the ISS power positive state during the FDIR use, and 
available information related to the validation of the process. 

The following is an outline of the assessment plan: 

1. Basis of PCU as a control 

i. Proposed forecast adequacy to determine PCU control utilization review 
hazards [ISS-EVA-312-AC, 2012] 

ii. Review the forecasting process 

1. Sources 

2. Limits 

3. Proposed changes 

iii. Review of PIM3.0 charging model adequacy for forecasting 

1 . Prediction capabilities 

2. Error bars 

3. Accuracy of prediction for the FP 

a. Magnitude of values 

b. Forecast time length: Can it accurately predict 2 to 3 or up 
to 14 days? 
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2 . 


3. 


c. What boundaries shall be in place based on what can and 
cannot be predicted? 

iv. FPMU role and criticality 

v. Review assumptions for the probabilistic risk assessment (PRA) 

Evaluate the FDIR 

i. Two-fault tolerance requirement 

1. Two operational PCUs are considered single fault tolerant 

2. For two-fault tolerance the ISS-NCR-232F list the two PCUs and 
have the FDIR (solar array shunt control algorithm) as third control 

ii. Risks 


1 . Is there a risk to the ISS power configuration? 

2. Are there risks of large negative events with the array shunting? 

3. How reliable is the system? Is it programmed for every EVA? 

4. Severity of hazard if one PCU fails 
Hazard controls marginalization 

i. Recommended analyses 

1 . Worst-case positive and negative potentials 

2. How much electrical circuit path current collection is realistic for a 
positive EMU charging? 

a. Compare to medical limits 

3. Evaluate charging events 

a. Eclipse exit normal charging 

b. Eclipse exit rapid charging event 

c. Auroral charging 

d. Array unshunt in sunlight 


The NESC team did not evaluate the EMU systems (i.e., electrical systems and instruments) to 
understand their susceptibility to the assessment hazards. In addition, the analysis in this 
assessment focused on the present ISS configuration and did not attempt to address the effects of 
possible configuration changes (e.g., future Russian solar arrays). 


6.0 Problem Description and Proposed Solutions 

6.1 Problem Description Summary 

The ISS vehicle undergoes spacecraft charging as it interacts with Earth’s ionosphere and 
magnetic field. The interaction can result in a large potential difference developing between the 
ISS metal chassis and the local ionosphere plasma environment. If an astronaut conducting an 
EVA is exposed to the potential difference, then a possible electrical shock hazard arises. 

This assessment evaluated the approach and methodology adopted by the ISSP, which relies on 
modeling to determine if hazardous charging conditions exists. The modeling was contrasted 
with the use of active charge mitigation devices (i.e., PCUs), which are in place on the ISS and 
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directly limit the potential difference between the ISS and the ionosphere plasma when they are 
operational. 

6.2 Background Information 

6.2.1 ISS and the Ionosphere/Plasma Environment 

The ISS orbits the Earth at an altitude of approximately 400 km. In this orbit, the ISS is 
continually moving through Earth’s ionosphere and magnetic field. The ionosphere, which is a 
plasma environment, is made up of a superheated gas in which the neutral atoms are converted 
into charged particles via ionization. The principle constituents of the ionosphere plasma are 
electrons (i.e., negatively charged particles) and oxygen ions (positively charged particles). 

Since the ionosphere plasma is comprised of charged particles, the interaction with the ISS can 
occur because of direct collisions or as a result of electrostatic attraction/repulsion. As opposite 
charges attract (e.g., positive attracts negative), like charges repel (e.g., positive repels positive). 
An example of electrostatic attraction of charged particles is the solar arrays on the ISS. The 
solar arrays are made up of silicon solar cells with an exposed edge. When illuminated by 
sunlight, the cells produce electrical power and achieve a positive voltage. Electrons in the 
plasma near a solar cell will be pulled towards the solar cell due to electrostatic attraction. Some 
fraction of the electrons attracted to the cell will be collected by the cell (since it is an electrical 
semi-conductor) and result in spacecraft charging. 

6.2.2 ISS Power System and Spacecraft Charging 

The ISS power system was electrically configured as a negative ground system. To understand 
this configuration, a solar array can be treated as a simple battery. The negative tenninal of this 
“battery” is connected to the ISS aluminum (Al) structure (or chassis) and the positive terminal is 
immersed in the ionosphere plasma. Accordingly, if electrons in the plasma are collected by a 
positively biased solar cell, they will ultimately accumulate on the ISS chassis as part of the 
negative ground power system arrangement. To characterize the amount of charge that might 
accumulate on the ISS chassis, an electrical reference point must be defined. On Earth’s surface, 
this reference point is Earth Ground. For the ISS, it is not practical to use Earth Ground as a 
reference. Instead, it is easier to choose the local plasma environment around the vehicle as the 
electrical reference point or “plasma ground.” Using this convention, the potential difference 
(voltage) that develops between the ISS chassis and the local plasma can be described. In the 
scenario where the solar cells collect electrons, which end up on the ISS chassis, a negative 
voltage developing on the chassis with respect to the local plasma can be described. 

6.2.3 Charged Particle Collection: Ions, Electrons, and FP 

A corollary to the electron collection scenario is ion collection. Exposed metal surfaces on the 
ISS chassis that are negatively biased with respect to the local plasma can collect ions 
(i.e., positive charges). In the spacecraft-charging arena, it is understood that equilibrium 
potential must be arrived at where the ion current collection balances the electron current 
collection. Known as the FP, it is dependent on the amount of ion collection area, the electron 
collection area, and the mass and energy of the electrons and ions in the plasma. For the 
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ionosphere plasma, the ions are massive compared to the electrons and the ions have very little 
thermal energy. Ions are mostly collected as a result of the ISS colliding with them - which is 
called RAM collection. The electrons, however, are very light and have a modest thermal 
energy, so they interact with all the surfaces on the ISS and can be easily collected by positively 
biased conductive (or semi-conductive) surfaces. Combining all of these factors, one finds that 
the typical equilibrium FP of the ISS chassis is a negative potential. 

6.2.4 Mitigating ISS Spacecraft Charging - PCUs 

When the design decision was made to use high-voltage (+160 volts (V)) solar arrays on the ISS, 
scientists and engineers familiar with the ionosphere plasma environment predicted that the ISS 
would experience significant spacecraft charging. To limit the ISS chassis charging due to solar 
array electron current collection, the spacecraft charging design team in the early 1990s 
recommended the use of PCUs. The PCUs would act as an effective “ground strap” to the local 
plasma. The PCUs operate by creating a plasma bridge between the ISS chassis and the 
ionosphere plasma. They move the excess charge accumulated on the ISS chassis back into the 
ionosphere, thereby minimizing any spacecraft charging. Thus, the ISSP developed and 
deployed two robustly designed PCUs. Each PCU was rated to continuously emit as much as 
10 amps of accumulated charge back into the ionosphere and respond to changes in the ISS 
current collection in a fraction of a second. The PCUs were designed and verified such that ISS 
chassis potential would never go more negative than -40V when the PCUs were operating. 

6.2.5 Potentials Generated by Magnetic Induction 

Charging on the ISS chassis is actually a combination of current collection by charged surfaces 
(described above) and induced potentials created by magnetic induction. The magnetic induction 
occurs as a result of the long metallic ISS truss structure moving through field lines in the 
Earth’s magnetic field. Like a wire in a conventional electric generator, the ISS develops a 
potential difference (voltage) across its length as it moves through a magnetic field. The formula 
that governs the induction voltage is Seduced = v x B • L, where v is the spacecraft velocity 
vector, |B| is the magnetic field strength, and |L| is the length of the conductor. This equation is 
actually a vector equation, which means that the orientation of the conductor with respect to the 
magnetic field is important. Often referred to by the shorthand “v cross B”, the magnetic 
induction potential can have a net magnitude as high as about 38V (see Appendix G) measured 
from truss tip to truss tip. Thus, the potential that is created by magnetic induction (v x B • L) 
across the ISS is a function of position along the truss. 

6.2.6 Insulating Surfaces, Anodized Components, and Capacitors 

Like most other spacecraft, the ISS is made up of a wide variety of materials, including 
electrically conductive and electrically insulating materials. When electrically insulating 
materials or dielectric materials are exposed to the ionosphere plasma environment, their surface 
can become electrically charged. An important example of an insulating material charging on 
the ISS is the case of the micrometeoroid and orbital debris (MMOD) shields. The MMOD 
shields are anodized Al. The anodizing process creates a significant thin oxide layer on the A1 
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surface (for corrosion protection). The A1 metal is a good electrical conductor, the anodization 
layer, however, is a good electrical insulator (dielectric). The MMOD shields fonn the outer 
surface of the ISS pressurized modules. The A1 metal in the MMOD shields is attached to the 
chassis and the oxide layer (anodized coating) is exposed to the ionosphere plasma. This 
arrangement can be described in electrical circuitry terms as a parallel plate capacitor. 

Recall that a parallel plate capacitor is a device made up of two electrically conductive plates 
separated by a dielectric material. To characterize the MMOD shields as a capacitor: one of the 
capacitor plates is the A1 metal, the dielectric material between plates is the anodization layer, 
and the other “plate” is the plasma. Given the large amount of surface area associated with the 
MMOD shields and the significant thin anodization layer, it turns out that the capacitance of the 
ISS modules can be quite large - on the order of milli-Farads [Carruth, 2001]. 

Three important features of capacitors are: 

1 . Charge Storage - a large capacitance translates to a capacity to store a large amount of 
charge. 

2. Direct Current (DC) Blockage - only changing or pulsed currents can pass through a 
capacitor. 

3. Pulse Discharge - shorting across the plates of a charged capacitor or dielectric 
breakdown can produce a large pulse of current out of the capacitor. 

Given the large capacitance of the ISS MMOD debris shields, it can be expected that a great deal 
of charge can be stored and, in turn, sourced as a large current pulse when the capacitor terminals 
are shorted. An electrical arc across a capacitance is equivalent to shorting the capacitor with a 
switch. 

Of the many external surfaces on ISS that can be characterized as capacitors, three areas figure 
prominently in this assessment: 1) the main ISS structure capacitance associated with the 
MMOD shields, 2) the solar array capacitance, and 3) the EMU capacitance. It should be noted 
that the capacitance associated with the MMOD shields is very large compared to the solar array 
and EMU capacitances. 

Reference: 

1. Carruth, Jr., M.R., et al. (2001): “ISS and Space Environment Interactions without Operating 
Plasma Contactor,” AIAA-200 1 -40 1 , Aerospace Sciences Meeting and Exhibit, 39th, Reno, 
Nevada, January 9-11, 2001. 

6.3 Detailed Problem Description 

6.3.1 ISS Charging 

The conditions that generate a plasma hazard on ISS arise when a difference in potential 
develops between the ISS chassis and the surrounding ionosphere plasma, which is the defined 
electrical reference point. The two sources that create this potential difference (voltage) are: 

(1) electron current collection on the high voltage (+160V) solar arrays which drives the ISS 
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chassis to negative potentials, and (2) the magnetic induction voltage generated across the long 
truss structure as it moves through the Earth’s magnetic field. 

The electron collection on the solar array occurs when the solar array is illuminated by sunlight 
and connected to the power system. The array output can be short-circuited through an operation 
known as shunting. If an array is shunted, the electron current collection from the plasma does 
not charge the ISS chassis since it is also short-circuited. The magnetic induction voltage 
generated across the length of the truss changes depending on the orientation of the truss to the 
magnetic field. 

6.3.2 Plasma Shock Hazard for EVA Astronauts 

The plasma hazard occurs when an astronaut conducting EVAs is exposed to the potential 
difference between ISS and the local plasma as a result of an electrical connection being made to 
the EMU (spacesuit). The magnitude and the nature of the hazard condition are dependent on 
the astronaut’s location along the vehicle as well as some vehicle operations (e.g., PCU on/off, 
solar array state, etc.). Figure 6.3-1 provides a pictorial representation of the ISS spacecraft 
charging that results from solar array current collection and magnetic induction (i.e., v x B • L). 
Figure 6.3-1 shows that the v x B • L voltage is distributed along the truss such that one end of 
the truss can be at a more positive voltage than the other end. 



Figure 6.3-1. ISS Potential with Respect to the Local Ionosphere Plasma. The ISS potential is a 
combination of solar array current collection and magnetic induction (or v x B • L). 

6.3.3 PCUs 


To dramatically reduce the negative charging that occurs on the ISS chassis due to solar array 
electron collection, the PCU was developed for the ISS. The PCU acts as an effective “ground 
strap” to the local plasma. The purpose of this device is to mitigate the negative charging hazard 
by returning excess charge accumulated on the ISS chassis back to the ionosphere plasma. This 
provides mitigation to the negative FP hazard by keeping the station chassis potential more 
positive than -40V. There are two independently powered and controlled PCU systems installed 
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on the ISS and together they provide a single-fault tolerant control against the negative FP 
hazard (Figure 6.3-2). A third unit is in storage at the ISS. For operational description of the 
PCU, see Appendix H for reference to Section 2.3.4 of the International Space Station Electrical 
Power Systems Training Manual ISS EPS TM 21109 [Anon., 2004]. 



Figure 6.3-2. PCU Installed on ISS (Source: NASA) 


Reference: 

1. Anon. (2004): ISS Electrical Power Systems Training Manual, ISS EPS TM 21109, Mission 
Operations Directorate, Space Flight Training Division, NASA Johnson Space Center, 2004. 

6.3.4 Hazard Classification and Protection Systems 

Given that the plasma hazard is an electrical shock hazard for an EVA astronaut, it has been 
classified as a catastrophic hazard. In this classification, a two-fault tolerant hazard control must 
be employed. To meet the two-fault tolerant requirement, the ISSP has employed two PCUs and 
an automatic array shunting algorithm referred to here as solar array shunt FDIR, or just FDIR. 
The solar array FDIR algorithm is enabled after the two PCUs are in discharge. If the FDIR 
detects that one of the two PCUs have failed, the algorithm will shunt solar arrays (refer to the 
B9-908 document, “Plasma Hazard Mitigation during EVA”). Appendix F provides information 
received from the electrical power system (EPS) hardware operator in relation to the FDIR. To 
support the ISS power demands, ground commands to unshunt the arrays may occur any time, in 
or out of sunlight. However, to reduce the RAM electrical current collection, the commands are 
issued after the corresponding array is off-pointed from the velocity vector by >105 degrees. No 
more than two arrays can be unshunted and auto-tracked while being less than 105 degrees from 
the velocity vector. 

The EVA pre-planning efforts involve a short-term forecast where environment measurements 
are taken 14 days prior to the EVA (per ISS-NCR-232G). The ionosphere plasma environment 
measurements are made with the FPMU. The PCUs are off when the FPMU measurements are 
made so corresponding ISS potentials are indicative of the conditions uncontrolled by the PCUs. 
Calculations of the ISS chassis potential are made by using FPMU data in the empirical model 
PIM3.0. Configurations of the solar arrays resulting in calculated FPs more positive than 
-40V are acceptable and within the limits. In the event of a PCU failure, if the solar array 
management necessary to maintain the ISS in a “power positive” mode produces a chassis 
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potential more negative than -40V, then additional safety risk will be accepted up to the level of 
-45.5V. The hazard limit for the negative potential was set as -40V [ISS-EVA-3 12-AC, 2012]. 
However, side notes included on the ISS-provided overview presentations suggest an increased 
risk acceptance level for arc occurrence has been established to tolerate potentials as negative as 
-45.5V (1/14/2009 ISS Safety Review Panel (SRP)). However, the rationale for this move has 
not been documented in any reference this team has uncovered. 

Reference: 


1 . ISS-EVA-3 12-AC (2012): Electric Shock to EVA Crew Resulting from EMU Arcing in 
Plasma, 1/26/2012. 

6.3.5 FPMU 


The FPMU is a multi-probe instrument designed to measure: (1) FP, (2) plasma density, and (3) 
electron temperature from the ISS local ionospheric environment (see Figure 6.3-3). Refer to 
Figure 6.3-4 for the location of the PCUs and FPMU through the ISS assembly. The FPMU was 
installed with the goal to use its data for refinement and validation of the ISS spacecraft charging 
models and to determine the severity and frequency of ISS charging events. 


FPP 



TVCIC 


FPP: Floating Potential Probe 
WLP: Wide-sweep Langmuir Probe 
NLP: Narrow-sweep Langmuir Probe 
PIP: Plasma Impedance Probe 


Figure 6.3-3. FPMU Probes and Layout 
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FPMU 21 Nov 2009 - present 
PI Truss (y = -7.16 m) 


Plasma Contactor Units (2) 
Port side of Z1 Truss 


Port 


Solar Alpha 
RotaryJoint 
(SARJ) 


Starboard 


Solar Alpha 
RotaryJoint 
(SARJ) 


Pressurized Modules with Anodized 
Aluminum MMOD Shields 


FPMU 3 Aug 2006 to 21 Nov 2009 
SI Truss (y =+19.56 m) 


Figure 6.3-4. Location of the PCUs and the FPMU at the ISS. The FPMU has been in two different 

locations on ISS over the course of its lifetime. 


Reference: 

1. Wright, et al. (2008): “Charging of the ISS as Observed by the FPMU: Initial Results,” IEEE 
Transactions on Plasma Science, Vol. 36, No. 5, October 2008. 

6.3.6 PIM3.0 Charging Model 

The initial PIM charging model was developed by Science Applications International 
Corporation and Boeing Space Environments and is currently maintained by Boeing Space 
Environments. The latest revision of the PIM3.0 is used to calculate the ISS chassis potential 
and includes various processes such as: 1) the magnetic induction potentials due to motion of the 
vehicle through the Earth’s geomagnetic field; 2) the charging due to solar array and other 
current collection processes from the ionosphere plasma; and 3) PCU effects. Figure 6.3-5 
shows examples of the calculated potentials on the ISS using the PIM3.0 model. Figure 6.3-5 
also shows that the use of PCUs affects the potential distribution across the vehicle. Figure 6.3-6 
shows the effectiveness of the PCU at controlling the chassis potential (i.e., potentials with PCU 
on versus potentials with PCU off). The PCUs keep the ISS within the -40V limit when the 
PCUs are in discharge. 
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Figure 6.3-5. 2010 Comparison of Potential Calculations with PCUs On and Off [ Kramer, et al., 

2010 ] 


2010/103 Detail for 12- 24 UT 



Figure 6.3-6. Example ofFPMU Data showing the Effect on the Peak Chassis Potential (i.e., FP) 

when the PCUs are On and Off 

Reference: 

1. Kramer, L.; Hamilton, D.; Mikatarian R.; Thomas J.; and Koontz, S. (2010): “Positive 
Voltage Hazard to EMU Crewman from Currents through Plasma,” Proc. 4 th IAASS 
Conference ‘Making Safety Matter’, Huntsville, Alabama, USA, 19-21 May 2010 (ESA SP- 
680, September 2010). 
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6.3.7 Electrical Shock Hazard Scenarios 

The electrical shock hazard associated with EVAs is based on a situation in which an electrical 
circuit is established that could inject an electrical current into a crew member inside an EMU. 
Critical to the establishment of a shock hazard is the fact that EMU crew members wear a 
cooling garment against their skin, which quickly becomes soaked in perspiration as an EVA 
commences. The close confines of the EMU, combined with the layer of perspiration that covers 
the crew member’s body, results in a situation where there is electrical contact between the crew 
member and the metal components used at several locations in the EMU construction. Thus, if 
electrical current flows through an EMU, there will be a parallel path through the crew member’s 
body, which represents a hazardous situation for the crew member (i.e., a shock hazard). The 
severity of this hazard ranges from a small shock on the skin that causes the astronaut to be 
startled, to a catastrophic situation in which current flows through the astronaut’s thoracic cavity 
and causes defibrillation or arrest of the heart (see Appendices A and B). 

Two charging scenarios on the ISS must be assessed to determine if they give rise to an electrical 
shock hazard: 

1) Negative charging 

2) Positive charging 

Given that astronaut safety is at stake, the most conservative approach is taken to assess the 
electrical circuit associated with each charging scenario. Specifically, the circuit that is 
evaluated is the one that can lead to electrical current flow through the astronaut’s thoracic 
cavity. This circuit is created when current enters a lower portion of the EMU (i.e., the waist 
area), and then flows through crew member’s body and exits at a point in the upper portion of the 
EMU (e.g., the neck area). 

6.3.8 Hazard Circuit Associated with Negative Charging 

In the case of a negative charge being applied to the EMU, the hazard that arises is from current 
flow due to an electrical discharge (arc) on an anodized A1 component somewhere on the EMU. 
With a crew member in a perspiration-soaked garment that is in electrical contact with portions 
of the EMU, as current flows through the EMU to an arc site, a portion of the current can flow 
through the crew member’s body. The arcing scenario associated with negative potentials on the 
ISS and applied to the EMU can be visualized in Figures 6.3-7a through 6.3-7e. The choice to 
separate the negative charging hazard circuit into several circuit diagrams was made to not only 
illustrate how the situation develops, but to also indicate that multiple events must occur 
simultaneously in order for the actual hazard to be created. 
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Circuit Element Definitions 
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Plasma Current 


Plasma Ground 


ISS Exposed Conductor 


Connection to ISS chassis 
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ISS Solar Array 



Astronaut in EMU 


e~ Electrons (negatively charged particles) 
in Ionosphere Plasma 


0 + Oxygen Ions (positively charged particles) 
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Figure 6.3-7a. Circuit Element Definitions used in Circuits #1, #la, #2, and #3 (below) 
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Figure 6.3- 7b. Circuit Diagram showing Solar Array Current Collection and related Charging of 
the ISS. In steady state, the ISS chassis potential (or FP) adjusts to achieve current balance, such 

that the Ion Current = Electron Current. 
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Figure 6.3-7c. Circuit Diagram showing the Scenario where an EVA is being Conducted. There is 
no direct electrical connection between the charged ISS chassis and the EMU (space suit). 
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Figure 6.3-7d. Circuit diagram showing the scenario where a direct electrical connection is 
established between the charged ISS chassis and the EMU (space suit). In this situation, there is a 
small electron current that flows from the ISS chassis to the EMU. Only a small amount of electron 
current flows to the EMU due to limitations in RAM ion current collection on C EMU . 
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Figure 6.3-7e. Circuit diagram showing the scenario where an arc occurs on an anodized component 
of the EMU (space suit). A large current of electrons flows through the EMU to the arc site. With a 
crew member inside a perspiration-soaked garment in the EMU, there is electrical contact between the 
crew member and various EMU metal components. Current flowing to the arc site can follow a 
parallel path through the crewmember. Arc current magnitude can exceed 10 amps as electrons in the 
arc plasma neutralize nearby anodized surfaces on the ISS vehicle (one side of C IS s). If a fraction of 
the arc current flows through the crew member, a significant hazard occurs. The source of the large 
arc current is the Cm, which is a very large capacitor. 

Summary - Negative Charging Hazard 

The shock hazard associated with negative charging on the ISS vehicle is by a situation in which 
an electrical discharge (arc) forms on an EMU component. The simple application of a negative 
charge on the EMU does not create a hazard. The application of a negative charge on the EMU 
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must result in an arc occurring before the hazardous situation arises. The crew member in an 
EMU is inside a perspiration-soaked gannent, which provides electrical contact between the 
crew member’s body and metal components that make up the EMU. Therefore, if current flows 
in an EMU due to an arc occurring on an external component, the crew member’s body may be 
subjected to current flow as it represents a parallel path for a portion of the arc current. 

The formation of an arc on an EMU requires the simultaneous occurrence of multiple events, 
which means the likelihood of an arc occurring is very low. As depicted in Figures 6.3-7a 
through 6.3-7e, for an arc to occur on an EMU, the following must happen: 

1) The ISS vehicle must experience spacecraft charging to negative potentials, as shown in 
Figure 6.3-7b. 

2) A bare metal component on an EMU must make electrical contact with a bare metal 
component on the ISS chassis. This situation is shown in Figure 6.3-7d. 

3) Anodized A1 components on the EMU must develop a potential difference across their 
anodization (oxide) layers (i.e., negative charge on the surface against the A1 metal and 
positive charge on the surface exposed to the plasma). In Figure 6.3-7d, the potential 
across the anodization layer is represented by the electrical charges on the element 

55 

'-EMU* 

4) An anodization (oxide) layer must breakdown and generate an arc. In Figure 6.3-7e, the 
arc on an anodized component is shown as the lightning bolt across the element “Cemu-” 

5) Charge from the ISS vehicle must flow through the EMU to the arc site - which means 
the EMU must remain electrically connected to the ISS chassis throughout the charging 
and arcing process. In Figure 6.3-7e, the large current through the arc site is provided by 
the capacitance of the ISS vehicle represented by “Ciss-” 

If such a set of events were to occur, and an arc was generated on an EMU, the astronaut inside 
the EMU would most likely experience an electrical shock as electric charges move from the ISS 
chassis through the EMU into the arc site and return to the local plasma environment. With the 
crew member in electrical contact with EMU metal components, due to the perspiration-soaked 
gannent covering the crew member’s body, some of the arc current can split into the parallel 
path created by the crew member’s body. Because the United States (U.S.) modules on the ISS 
are constructed in a manner that results in a large effective capacitance, the magnitude of current 
flow (charge movement) through an EMU arc site is possibly very large (>10 amps). If only a 
small fraction of the arc current goes through the crew member’s body, a potentially catastrophic 
situation can be created. 

A key to all electrical shock hazards associated with the EMU is that bare metal on the EMU 
must make electrical contact with bare metal on the ISS vehicle in order to charge the EMU. 

Due to the nature of the construction of the EMU and ISS vehicle, it is very unlikely that an 
electrical contact can be established, let alone maintained, for the time period required to 
establish a hazardous charging situation (negative or positive). 
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6.3.9 Hazard Circuit Associated with Positive Charging 

A crew member inside an EMU is in electrical contact with the metal surfaces in the EMU 
because the crew member’s body is covered in a perspiration-soaked garment (the liquid cooling 
and ventilation garment (LCVG)). The crew member can, therefore, become part of an electrical 
circuit in which current can flow and a shock can be delivered. In the case of the negative 
charging hazard (described in Section 6.3.8), an arc generates the hazardous situation. In the 
case of positive charging of the EMU, current flow in the EMU (and the crew member’s body), 
can occur as the capacitance of the EMU is charged by electron current from the local plasma. A 
bare metal component on the EMU must contact a bare metal component on a positively charged 
section of the ISS vehicle. In this scenario, the EMU metallic structure becomes positively 
charged and electrons are attracted to the external surfaces of the EMU. Anodized components 
of the EMU act as capacitors and can be collectively treated as a single capacitance “Cemu-” It is 
possible that as the capacitance of the EMU charges due to electron current from the plasma, the 
crew member’s body, that is part of the EMU circuit, will be impacted by the current flow. The 
positive charging hazard, therefore, is initiated when the EMU metallic structure charges to 
positive potentials with respect to the local plasma. 

While the PCUs are in discharge, the ISS is grounded close to the center of the station where the 
units are located. At precisely the PCU location, the potential is around - 10V since there is a 
10V drop across the device. The difference in potential across the truss due to v x B-L is on the 
order of ~38V. With the PCUs on, a maximum positive potential is on the order of 10V 
(accounting for the PCU potential drop) can be seen as the calculated FP in Figure 6.3-5. 
Considering the positive potential electrical current path (Figure 6.3-8), the hazard is from the 
electron current collection during charging of the EMU capacitance (i.e., the capacitance due to 
external anodized components). The plasma impedance for collecting electrons when the 
potential is positive is high, thus limiting the electrical current in the path. This current lasts on 
the order of 1 microsecond (ms) and it is in the order of 1 milliampere (inA). See Section 7. 10 of 
this report for details. The hazard control documents ISS-EVA-3 12-AC and the ISS-NCR- 
232F/G do not specify a positive potential or electrical current collection limit. References to 
electrical current threshold for human reaction can be found in Appendices A and B of this 
report. 
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Figure 6.3-8. Positive Potential Electrical Current Path through the Crew Member. 

Note the crew member’s body can become part of the electrical circuit due to contact of the 
perspiration-soaked cooling garment covering the crew member with internal metal structures in the 

EMU. 

6.3.10 Shock Hazard Probabilities 

The probability of a shock hazard developing during an EVA involves the probability of large 
chassis potentials developing combined with the probability of completing the electrical current 
path through the EMU. The ISS Probabilistic Risk Assessment for Shock Hazard, ISS-PRA-12- 
56 (May 17, 2013), lists the simultaneous events for a shock hazard to occur and reports the 
probability as 6.72E-06, which can be improved to 9.44E-08 with additional isolation to the 
operational bioinstrumentation system (OBS). 

Fundamental to the establishment of both the negative and positive shock hazard circuit are the 
following two conditions: 

1) The crew member’s body must be in electrical contact with exposed metal inside the 
EMU at two separate locations. 

2) An electrical connection must be made between ISS structure and the EMU (i.e., exposed 
metal on the exterior of the vehicle must connect to/touch exposed metal on an exterior 
surface of the EMU). 

With respect to the first condition, the crew member’s body is covered with a LCVG, which 
quickly becomes soaked with perspiration as an EVA begins. The wet LCVG increases the 
likelihood of electrical contact between the crew member’s body and metal components on the 
interior of the EMU. Figure 6.3-9 shows the locations of possible metal contact in the EMU suit. 

Electrical connection between exterior bare metal surfaces on the ISS vehicle and the EMU is a 
low probability condition due to the prolific use of anodized A1 on both the vehicle and the 
EMU. (Recall that anodized coatings are electrically insulating). To further decrease the 
probability of bare metal contact between the exterior surfaces on the vehicle and the EMU, 
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isolation features were implemented (circa 2009) into the EMU’s Modular Mini Workstation 
(MMWS) exposed metal (refer to ISS-NCR-232F, Attachment 7 and Volume II, Appendix D) 
Kapton® film was placed between the A1 baseplate and the stainless steel receptacles 
(Figure 6.3-10) and hard anodized washers were used to isolate conductive paths through the 
fasteners. These modifications were validated through ground testing [Castillo, 2010], which 
included isolation and mechanical stress tests. 



Figure 6.3-9. EMU Suit External Metal Locations [ISS-NCR-232F Attachment 5, 2012J 
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Figure 6.3-10. Modifications to the MMWS (“tool belt”) [ISS-NCR-232F, Attachments 5 and 7, 

2012 ] 


References: 


1 . Castillo, M. (20 1 0): Modular Baseplate Assembly/Body Restraint Tether /Handrail Electrical 
Continuity Test, dtd. 05/04/10. 

2. ISS-NCR-232F (2012): Lack of Two-fault Tolerance to EVA Crew Shock in the Low Earth 
Orbit Plasma Environment, 1/31/2012. Attachments. 

3. ISS-NCR-232F (2012): Lack of Two-fault Tolerance to EVA Crew Shock in the Low Earth 
Orbit Plasma Environment, 1/31/2012. Attachments 5 and 7. 

6.3.11 Approach to EVAs Without a Two-Fault Tolerant Hazard Control 

The negative potential limits and hazard controls discussed so far are referenced in the ISS-NCR- 
232F. This version of the “ Lack of Two-fault Tolerance to EVA Crew Shock in the Low Earth 
Orbit Plasma Environment ” document was the active hazard control guidelines at the start of this 
assessment. However, on September 2013, a new version, G, of the document was signed. 

Figure 6.3-1 1 summarizes the differences between the two guidelines as well as the 
recommendations from this assessment relative to the controls. In summary, the new guidelines 
(1) extends the “short-term” forecast to 14 days prior to an EVA, (2) updates the FP risk 
acceptance limit to -45.5V, and (3) provides guidelines for the use of controls based on the 
14-day FP calculations from the forecast. The extension of the forecast based on the 


NESC Request No.: TI-13-00869 



@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

13-00869 

Version: 

1.0 

Title: 

ISS PCU Utilization Plan Assessment Update 

Page #: 

33 of 225 


environment measurements taken 14 days prior to the EVA is based on the environments 
persistence of condition (the environment today is the same as it would be in 14 days) and the 
solar cycle predictions remaining “benign” at least through Solar Cycle 25 which extends 
through 2030 (ISS mission). Because operation of the PCUs increases the magnitude of the 
positive potential at certain points on the vehicle, the new control guidelines are biased towards 
not operating the PCUs (i.e., PCUs not in discharge). 

The new NCR document establishes the following for controls based on the calculation of the 
ISS potentials 14 days in advance of an EVA: 


1) When the 14-day forecast calculates FP more positive than -45.5V, then: 

- for EVAs inboard the solar alpha rotary joint (SARJ), use of the PCUs is optional 
and the array shunt FDIR is not required. 

2) When the 14-day calculates FP more negative than -45.5V, then: 

- for EVAs inboard of the SARJ, use the two PCUs in discharge with the array 
shunt FDIR enabled. 

3) Because of the positive FP outboard of the SARJ when the PCU is on, the PCU will not 
be used for EVAs outboard of the SARJ. 

4) If the PCUs are required due to extreme negative potentials, the ISS will be placed in the 
y-axis in the velocity vector (YVV) orientation to mitigate the positive hazard. 

5) If the YVV orientation is not possible, then the ISS-PRA- 12-56 low probability of shock 
hazard (which includes the isolation modifications to the MMWS) will be used as 
justification against the hazard. Additional isolation to the OBS would be added. 


Original Approach NCR232G Approach NESC 

ISS-NCR-232F (New - Recently Approved by ISS) Recommendations 


Assume there is a 

Use 14-day forecasting to assess if the conditions 
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hazard and employ a 
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two failure tolerant 


Potential hazard and 

control approach: 
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(which given model and its capability will be most 

tolerant control 
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OBS isolation 

• if YVV not possible: use the low probability of 
completing the circuit; and 
additional OBS isolation 

control . 


Figure 6.3-11. Comparison of Hazard Control Approaches 
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6.3.12 Data Supporting NESC Recommendations 

Section 7.0 presents the supporting information for the NESC recommendations to revise the 
new guidelines [ISS-NCR-232G, 2013]. However, the NESC team recommends a combination 
of controls different from the earlier version [ISS-NCR-232F, 2012] of the guidelines. The 
recommended hazard control plan is to use the two PCUs in discharge for all EVAs regardless of 
location, and the EMU isolation features, which predict a low probability of contact, as the three 
controls. As for the positive potential hazard, the NESC position is that it is not a threat even 
under the worst-case positive potential (+15V) and the maximum exposed metal area in the 
EMU. 

References: 

1. ISS-NCR-232G (2013): Lack of Two-fault Tolerance to EVA Crew Shock in the Low Earth 
Orbit Plasma Environment, NCR-20264-R7, 18 September 2013. 

2. ISS-NCR-232F (2012): Lack of Two-fault Tolerance to EVA Crew Shock in the Low Earth 
Orbit Plasma Environment, 1/31/2012. 

7.0 Data Analysis 

The use of active controls to prevent the shock hazard (e.g., PCUs and shunt array FDIR) was 
evaluated based on the data and analyses presented in this section. The recent ISS Safety team’s 
proposed control-use approach triggered questions related to the adequacy of the forecast and the 
tools associated with the output calculations and limits for FP subsequently used for safety- 
critical decisions. The various FP scenarios and events were considered and examples are 
provided below. These examples of charging events were considered along with the solar array 
shunt FDIR operations to identify non-characterized issues during the array management. 

Several aspects of the PCU utilization were studied to determine reasons that would merit the 
discontinuation or limitation of the PCU use. The PCU adequacy to support the ISS mission (up 
to 2030) was considered from the capability and reliability perspective. The positive ISS truss 
FP bias introduced when the PCUs are in discharge seems to have been a factor against its use. 
Therefore, the electrical current collection scenario under the positive FP conditions was 
analyzed with the purpose to understand the severity of the positive potential hazard. 

Other aspects studied in this assessment involve the probability of completing an electrical 
current path from the ISS through the EMU suit through the crew member. This condition was 
studied considering the isolation layers in this path that include most recent modifications to the 
suit-tool configuration. 

7.1 Shortcomings in the Space Weather Forecast Planning that Limits its 
Utility for Forecasting 

The proposed strategy for forecasting ISS charging levels 14 days in advance of an EVA as 
described in ISS-NCR-232G has technical issues. The strategy involves forecasting space 
weather conditions and using the forecast conditions as input to the PIM3.0 charging model. The 
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issues with the forecasting process must be addressed before the strategy is used by the ISSP for 
making safety critical decisions regarding EVAs. 

7.1.1 Persistence of Conditions Assumption is Not Accurate 

No sophisticated space weather modeling technique is being used in the 14-day space weather 
forecast. The plasma electron density (Ne) and plasma electron temperature (Te) “forecast” is a 
simple persistence of conditions method based on the assumption that space weather conditions 
in 14 days will be the same as on the day the FPMU measurements are obtained. FPMU 
measurements are obtained on a reference day about 14 days in advance of a scheduled EVA and 
used to document the current Ne and Te values along the ISS orbit. The FPMU data are then 
compared to output from a statistical version of the IRI model to determine which statistical 
estimate for Ne and Te deviations at ±la, ±2a, and ±3a levels (where a is the standard 
deviation) about the IRI model best represents the measured FPMU data. The selected statistical 
IRI model output is used to generate Ne and Te values along the ISS orbit that are input to the 
PIM3.0 charging model to predict ISS charging 14 days in advance of the EVA. 

The National Oceanic and Atmospheric Administration’s (NOAA) Space Weather Prediction 
Center (SWPC) (the Federal entity chartered with providing official U.S. government space 
weather forecasts) only issues 3-day forecasts of solar flare activity and geomagnetic storm 
conditions which could impact ionosphere electron density and temperature conditions 
(http://www.swpc.noaa.gOv/wwire.html#swxdaypre) . 

NOAA SWPC does provide a 45-day forecast of geomagnetic Ap and solar FI 07 indices 
(http://www.swpc.noaa.gov/ftpdir/latest/45DF.txt) that could be used to provide the predicted 
FI 07 values required to run the IRI model. However, no guidance is provided in ISS-NCR- 
232G or the plasma hazard assessments available to the study team for review [Hartman, 
2013a,b; Schmidl, 2013b] as to how future FI 07 values are obtained for use in the generating the 
plasma hazard assessments. 

References: 

1. Hartman, D. (2013a): Plasma Hazard Relief Assessment for US EVA 22, ISS-HOU-ENV- 
WAH- 130032, 25 June 2013. 

2. Hartman, D. (2013b): Plasma Hazard Relief Assessment for US EVA 23, ISS-HOU-ENV- 
WAH-130035, 2 July 2013. 

3. Schmidl, D. (2013b): Plasma Hazard Relief Assessment for US EVA 21, ISS-HOU-ENV- 
WDS-1 10018, 10 May 2013. 

7.1.2 Dependency on Benign Solar Cycle is Unreliable 

ISS-NCR-232G provides a statement that "the Space Environments community has concluded 
based on the downward trend of recent Solar Cycles that the environment will remain benign at 
least through Solar Cycle 25 which extends through 2030. ” It is not clear from the document 
what group the term “Space Environments Community” is intended to represent. The general 
consensus of this NESC team is that, based on the poor results from the solar physics community 
in predicting the low activity state of the current Solar Cycle 24, it is unlikely there is any 
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physical basis for making quantitative predictions of activity levels through the end of Solar 
Cycle 25. 

The ability of the solar physics community to forecast solar activity for a complete solar cycle in 
advance is limited at best. Figure 7.1-1 from Pesnell [2008] shows a collection of predictions for 
the annual averaged sunspot number (Rnn) at the peak of Solar Cycle 24, which were all made 
before Solar Cycle 24 started. 


A few of the prediction techniques gave values close to the local maximum of R = 67 that was 
observed in February 2012 [Biesecker et ah, 2013]. However, a number of the predictions are 
lower than the observed maximum in 2012 and most of the predictions are significantly higher 
than the observed maximum. Some of the predictions even give values in the range of R = 180 
with error bars extending over R = 200. Such high values typify the solar cycle maxima from 
past cycles, thereby demonstrating that pre-Solar Cycle 24 predictions varied from historic lows 
to typical highs. Predictions of Solar Cycle 25 activity using some, or all, of these same 
techniques will likely result in the same large range of predicted activity levels. Additional work 
is required before forecasts of solar activity in future cycles can be claimed with any real 
accuracy [Pesnell, 2008, 2012]. 
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Figure7.1-1. Predictions of Solar Cycle 24 Sunspot Maximum 
Colored bars show the wide range of Solar Cycle 24 sunspot maxima values obtained from different 

prediction techniques [Pesnell, 2008]. 
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References: 

1. Pesnell, W.D. (2008): “Predictions of Solar Cycle 24,” Solar Phys., 252, 209-220, 2008. 

2. Biesecker, D.; Balch, C.; and McIntosh, S. (2013): “Where is Solar Cycle 24? Did it happen 
already? Is There More to Come?” Presented at the NOAA 2013 Space Weather Workshop, 
Boulder, Colorado, 16-19 April 2013. 

3. Pesnell, W.D. (2012): “Solar Cycle Predictions (Invited Review),” Solar Phys., 281, 
pp. 507-532,2012. 

7.1.3 Use of the Climatological Model - IRI is Inadequate 

Use of the IRI model to generate the input values required for the PIM3.0 charging model 
calculations is problematic in two significant areas. First, the IRI model itself is only a monthly 
average climatology model not intended for use in predicting changes in ionospheric Ne or Te 
values over shorter time periods. Second, the model is incapable of predicting the full range of 
environments responsible for ISS charging, including auroral electron flux and plasma depletions 
at low latitude eclipse exit where the strongest ISS charging to date has been observed. IRI 
models only the ambient background plasma conditions within the ionosphere and contains no 
model for the physics of energetic auroral electrons that are responsible for auroral charging. 

The eclipse exit rapid charging events that represent some of the largest ISS charging observed 
to date (in the -40 to -67V range) have been shown to occur in plasma density depletions at 
high latitudes and in dawn density depletions in the equatorial region. IRI does provide some 
representation of the low plasma density in high latitude ion troughs, but regularly 
underestimates their magnitude. The physics for dawn density depletions is not included in the 
IRI model. 

7.1.4 Missing Short Term Changes in the Plasma Environment: Geomagnetic Storm 
Activity 

Examples of the plasma hazard assessment’s provided to the ISS program before each EVA 
reviewed for this study [Hartman, 2013a,b; Schmidl, 2013b] do not include information on the 
current state of geomagnetic activity, which is a significant issue. Geomagnetic storm activity 
tends to deplete the ionosphere of plasma density and increase the electron temperature. These 
changes actually serve to suppress ISS solar array charging because the reduction in electron 
density reduces the amount of electron current to the solar cells and the higher electron 
temperature increases charging of the cover glass material on the solar cells. This, in turn, 
increases the barrier potentials and reduces the amount of electron current that reaches the solar 
cell. Measurement of the ionospheric Ne and Te values during a geomagnetic stonn period will 
give values representative of suppressed ISS charging conditions. Once a geomagnetic storm 
ends — typically on time scales of 12 to 24 hours — the electron density and temperatures recover 
to the pre-storm values, which will result in higher charging levels. Obtaining the reference data 
for the 14-day forecast during a geomagnetic storm period almost certainly guarantees the 
charging environment will be underestimated for the time period of an EVA. There is no release 
documentation suggesting that this effect has been considered in development of the 14-day 
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forecast products and no documented plans to deal with FPMU data obtained during disturbed 
periods when reference data may under represent environment in 14 days. 

References: 

1. Hartman, D. (2013a): Plasma Hazard Relief Assessment for US EVA 22, ISS-HOU-ENV- 
WAH- 130032, 25 June 2013. 

2. Hartman, D. (2013b): Plasma Hazard Relief Assessment for US EVA 23, ISS-HOU-ENV- 
WAH-130035, 2 July 2013. 

3. Schmidl, D. (2013b): Plasma Hazard Relief Assessment for US EVA 21, ISS-HOU-ENV- 
WDS-1 10018, 10 May 2013. 

7.1.5 Inconsistencies in Input Parameters 

An additional issue identified with use of the forecast tools is an inconsistency in the use of 
different versions of the IRI models. The plasma hazard reports reviewed for this study 
[Hartman, 2013a, b; Schmidl, 2013b] indicate the IRI-201 1 model is used for the plasma hazard 
assessment. However, the plasma variability model that is used to obtain the ±la, ±2a, and ±3a 
level deviations in the Ne and Te values about the IRI model output was derived from comparing 
satellite data with the IRI-2001 model [Minow, 2004]. No evidence was presented to 
demonstrate that the statistical variability levels for Ne and Te values derived from the older IRI- 
2001 model are still applicable to the newer IRI-201 1 version of the ionospheric climatology 
model. 

References: 

1. Hartman, D. (2013a): Plasma Hazard Relief Assessment for US EVA 22, ISS-HOU-ENV- 
WAH- 130032, 25 June 2013. 

2. Hartman, D. (2013b): Plasma Hazard Relief Assessment for US EVA 23, ISS-HOU-ENV- 
WAH-130035, 2 July 2013. 

3. Schmidl, D. (2013b): Plasma Hazard Relief Assessment for US EVA 21, ISS-HOU-ENV- 
WDS-1 10018, 10 May 2013. 

4. Minow, J.I. (2004): “Development and Implementation of an Empirical Ionosphere 
Variability Model,” Adv. In Space Res., 33, 887-892, 2004. 

7.1.6 Limited Validation Studies 

Reliability of the technique to give predicted ISS charging levels that are not exceeded during an 
EVA period would depend critically on the ionosphere exhibiting very low levels of Ne and Te 
variability over the forecast period. The ISS-NCR-232G argues that these conditions are met for 
the current Solar Cycle 24 because the lower than typical solar ultraviolet/extreme ultraviolet 
output has resulted in a depressed solar cycle with hotter electron temperatures that limit 
charging. What is required to test this prediction technique, however, is not an argument based 
on high electron temperatures, but rather comparisons of measured Ne and Te values on a 
reference day to those observed on the forecast day 14 days later. The only available material 
showing such a validation study [Hartman, 2013c] is limited to comparing FPMU Ne and Te 
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measurements at approximately 7-, 14-, 21-, and 30-day intervals from a single reference day 
measurement in the two time intervals Greenwich Mean Time (GMT) 2011/120-150 and 2013 
GMT 20-100. It is not clear why such a limited set of validation comparisons have been 
attempted since there are numerous long periods of FPMU data from recent years that can be 
used to conduct more extensive comparisons for validation. In addition, there are alternative 
data sets such as ground-based ionosonde measurements that can be used to test 14-day forecasts 
for periods of a year or more. 

No complete verification of the ability to predict ISS potentials 14 days in advance has been 
demonstrated. The validation studies for the 14-day forecast and PIM3.0 charging modeling 
strategy available for review have only shown that Ne and Te values have not significantly 
changed over 14 days for a few limited time periods. No attempt to forecast the ISS charging 
levels and then compare the measured potentials after 14 days to validate that charging values 
never exceed the forecast was provided to the NESC team. As a result, pieces of the forecast 
technique appear to work at least for a couple of isolated time periods, yet there has been no full 
validation study to demonstrate the technique. 

Reference: 

1. Hartman, D. (2013c): Extension of Plasma Forecasting, Boeing Space Environments, 2013. 

7.2 FPMU Role in the Forecast: Criticality and Alternate Data 

FPMU data are critical to the 14-day plasma hazard forecast approach because FPMU Ne and Te 
measurements are used to constrain which statistical set of IRI-2001 statistical model output will 
be used as input to the PIM3.0 charging model calculations of the ISS potentials. In order to 
provide the plasma hazard forecast, a source of Ne and Te data to constrain the ionosphere model 
is required. A review of the NCR proposing to replace PCU operations with the plasma hazard 
forecast approach [ISS-NCR-232G, 2013] shows no explicit contingency procedure that outlines 
what to do if recent FPMU data are not available. 

Reference: 

1. ISS-NCR-232G (2013): Lack of Two-fault Tolerance to EVA Crew Shock in the Low Earth 
Orbit Plasma Environment, NCR-20264-R7, 18 September 2013. 

7.2.1 Ambiguity in Dataset Requirements 

The NESC team does note that in at least three of the plasma hazard relief assessment reports 
that were available to the team for review [Hartman, 2013a, b; Schmidl, 2013b], a statement is 
included indicating “if sufficient FPMU data are not available, then +2 a results may be used. In 
that case, the Space Environments team will provide those results.” If this vague statement is the 
contingency procedure intended to be followed when FPMU data are not available, then explicit 
information needs to be added describing what constitutes sufficient FPMU data and what 
conditions will require discontinuing use of the plasma hazard forecast process. For example, 
what total amount of data is the minimum required for the assessment? What quality of data is 
acceptable (and what metric is used for the quality assessment)? Which instrument(s) provide 
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the data for the analysis? Can data from any of the FPMU instruments be used or must the data 
come from a specific instrument? Details of this procedure must be documented in the NCR for 
review and concurrence by the ISSP to assure that inadequate FPMU data are not being used in 
the process. 

References: 

1. Hartman, D. (2013a): Plasma Hazard Relief Assessment for US EVA 22, ISS-HOU-ENV- 
WAH- 130032, 25 June 2013. 

2. Hartman, D. (2013b): Plasma Hazard Relief Assessment for US EVA 23, ISS-HOU-ENV- 
WAH-130035, 2 July 2013. 

3. Schmidl, D. (2013b): Plasma Hazard Relief Assessment for US EVA 21, ISS-HOU-ENV- 
WDS-1 10018, 10 May 2013. 

7.2.2 Alternatives for Ionospheric Data 

The FPMU is not the only source of ionospheric Ne and Te data. Alternative sources of 
ionospheric Ne and Te data should be evaluated by the ISSP for use as a contingency option for 
characterizing the plasma environment should FPMU data not be available. One possible 
example is the approximately 500 to 1000 electron density profiles provided by the 
FORMOSAT-3/COSMIC satellite constellation distributed over a wide range of latitudes and 
longitudes [Rocken, et ah, 2000; Schreiner, et ah, 2007; Anthes, 2011]. Another source of 
ionospheric plasma density data is the maximum F2-region electron density routinely measured 
by a global network of ionosonde stations and distributed by the NOAA SWPC every 30 to 60 
minutes [NOAA, 2014]. ISS orbital altitudes are typically above the F2-peak where the electron 
density is less than the F2-region peak values so this data would characterize the worst-case 
electron density for ISS charging. Finally, availability of data from the Global Assimilative 
Ionospheric Model (GAIM), or other full physics ionosphere models, should be evaluated for use 
in providing Ne and Te along the ISS orbit. GAIM is of particular interest because the model 
output is constrained by real-time data from a number of sources including ionosondes and 
satellites. 

References: 

1. Rocken, C., Kuo, Y.H.; Schreiner, W.; Hunt, D.; Sokolovskiy, S.; and McConnick, C. 

(2000): “COSMIC system description,” Terr. Atmos. Oceanic Sci., 1 1, 21-52. 

2. Schreiner, W.; Rocken, C.; Sokolovskiy, S.; Syndergaard, S.; and Hunt, D. (2007): Estimates 
of the Precision of GPS Radio Occultations from the COSMIC/ FORMOSAT-3 Mission, 
Geophys. Res. Lett., 34, L04808,doi:10.1029/2006GL027557. 

3. Anthes, R. A. (201 1): “Exploring Earth’s Atmosphere with Radio Occultation: Contributions 
to Weather, Climate and Space Weather,” Atmos. Meas. Tech., 4, 1077-1 103, 

doi: 1 0. 5 1 94/amt-4- 1077-2011. 

4. NOAA (2014), Space Weather Prediction Center, URL: 
http://www.swpc.noaa.gov/ftpdir/lists/iono day/README, accessed 21 May 2014. 
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7.2.3 FPMU Reliability 

A number of issues related to FPMU data availability and reliability must be considered when 
deciding whether to discontinue PCU operations in favor of the plasma hazard forecast approach. 
The FPMU was designed and built as Class 3 electronics (for a 3-year operational life). 
Reliability is provided by (a) redundant Ne and Te and FP measurements from multiple 
measurement techniques and (b) spare FPMU units to replace a failed unit [Swenson and 
Thompson, 2002]. Three flight and two engineering/qualification units were delivered to NASA 
with the assumption that flight units would be replaced with a spare when operational units 
failed. FPMU Serial Number 3 was deployed on the ISS during an EVA on August 3, 2006 with 
the first data received the same day. This same unit continues to serve as the operational FPMU 
instrument on the ISS and has collected data for approximately 709 days during the period 
starting August 3, 2006, and ending October 1, 2013, (the last time the data collection statistics 
were updated), representing 1.9 years of powered instrument operations over an on-orbit time of 
7.2 years. The data collection time is only approximate (within a few days) since it was obtained 
from a count of daily file folders generated by the FPMU ground station and not a detailed 
measure of the actual instrument operations time. FPMU operations are typically limited to 
about 100 days a year although operations in 2012 exceeded 130 days with no operational FPMU 
issues. 

Reference: 

1. Swenson, C.; and D. Thompson (2002): “FPMU Systems Overview,” presented at FPMU 
CDR, February 19-20, 2002. 

7.2.4 FPMU Design Life Limitations Compared To PCU 

Any recommendation to discontinue the use of the PCUs in favor of a process requiring FPMU 
data should balance the remaining life expectancy of the operational FPMU unit and the two 
flight spares against the expected life of the PCUs. PCUs were designed for long-term use in the 
space environment and finding 7 (F-7) in this report demonstrates the two operational PCUs have 
adequate xenon gas and a hardware design life to support their use past 2028. In addition, a third 
spare PCU unit is located on board the ISS with a full ta nk of xenon gas and a hollow cathode 
that has seen little use. 

In contrast, the cumulative design life for an FPMU unit is only three years and long-tenn 
reliability of the instrument is based on redundant measurements from the multiple probes and 
replacing failed units with flight spares. As of March 1, 2014, the operational FPMU unit will 
have been exposed to the space environment for 7.6 years, exceeding the cumulative 3-year life 
requirement for a single unit by 4.6 years. Limited life items used in the design of an FPMU 
include the cleaning lamp in the wide-sweep langmuir probe (WLP), and a thermal switch used 
in the survival heater. The cleaning lamp in the WLP sphere is not an issue because the cleaning 
lamp is no longer used in FPMU operations. The survival heater is required to run continuously 
when FPMU is outside the vehicle to protect the electronics from extremely cold temperatures. 
The thennostats are expected to cycle every 270 minutes and are rated for 10,000 cycles for a life 
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of 5.1 years [Utah State University, 2002]. The current operational unit has successfully 
exceeded the survival heater rating by 2.5 years. Additionally, radiation damage to the 
electronics is an issue because the FPMU was not built using radiation hardened parts. The ISS 
radiation design environments (Space Shuttle Program (SSP) 30512) indicate the 1-year total 
ionizing dose, due to trapped protons and electrons in silicon behind 5 mm of Al-equivalent 
shielding, is approximately 123 radiation absorbed dose (rad) [Space Station Program Office, 
1994]. Radiation sensitive components with this amount of shielding could exceed a total 
ionizing dose of 1000 rad in the next year based on the SSP 305 12 specification, a benchmark 
where commercial parts not selected for tolerance to radiation environments begin to show 
degradation. SSP 305 12 is a conservative design environment so the as-flown radiation dose is 
certainly lower, but a more thorough analysis of potential radiation effects on the FPMU is 
warranted to determine what additional time remains for the operational unit before replacement 
with the flight spare is required. 

While the FPMU currently in operation on the ISS has exceeded the design life, it has not been 
shown that the remaining spare flight units can be expected to operate for a similar period 
beyond the design life. Should the operational FPMU fail in 2014, the conservative assumption 
is the two flight spares will last the 3-year design life and can be expected to support the 
proposed plasma hazard forecast process only until 2020. If the two units last for periods 
approaching the flight experience of the FPMU operating on ISS, then the plasma hazard process 
could possibly be supported by FPMU data until 2028. 

References: 

1. Utah State University (2002): SDL 2002, FPMU Limited-Life Items List, SDL/02-037, 

Space Dynamics Laboratory, Utah State University, 7 February 2002. 

2. Space Station Program Office (1994): Space Station Ionizing Radiation Design Environment, 
Revision C, 3, SSP 30512, June 1994. 

7.2.5 Spare FPMUs - EVA Deployment 

Two additional FPMU flight units provide a backup to the operational unit on ISS. An FPMU 
(Serial Number 5) is stored on-board the ISS for use as a pre -positioned flight spare, but an EVA 
will be required to replace a failed unit. This EVA would have to be conducted without the 
benefit of FPMU data and the plasma hazard forecast process although operation of the PCUs 
during this EVA would mitigate the negative charging hazard. The third FPMU flight unit 
(Serial Number 2) is located in bonded storage at the Kennedy Space Center (KSC), but would 
require a flight to the ISS. 

7.2.6 FPMU Power Supply Limitations 

The use of the FPMU depends on availability of the television camera interface controller 
(TVCIC) and its power supply, because the TVCIC provides power to FPMU and the link 
between the FPMU and the ISS data telemetry system. The power supply in the TVCIC box 
currently in use with FPMU was launched with a known reliability issue [Kichak et al. 2009; 
Mikatarian, 2010] resulting in periodic shut down. Power cycling of the FPMU/TVCIC 


NESC Request No.: TI-13-00869 


@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

13-00869 

Version: 

1.0 

Title: 

ISS PCU Utilization Plan Assessment Update 

Page #: 

43 of 225 


combination is occasionally required to re-establish FPMU data flow. Spare TVCIC power 
supplies with a new design to correct the supply failure mechanism exists on-orbit, but the details 
for refurbishing the TVCIC with a spare power supply would need to be worked out should a 
failure occur. Finally, note that options presented as part of the ISS-NCR-232 update do not 
show contingency plans against a TVCIC power supply failure. 

References: 

1. Mikatarian, R.(2010): Operation of the FPMU to support plasma hazard assessments, 
FINAL-ShortVer-2010-04-13-SSPCB-FPMU-Requirements-revK.pdf April 13, 2010. 

2. Kichak, R., E. Young, C. Pandipati, and R. Cooke, International Space Station (ISS) External 
Television (TV) Camera Shutdown Investigation, NASA TM-2009-2 15572, NESC-RP-06- 
49/06-00 1-E, February 2009. 

7.3 Limitations of the ISS Charging Model PIM3.0 

Calculated values of the maximum ISS eclipse exit potential obtained from PIM3.0 charging 
model using measured FPMU Ne and Te at the time of the potential maxima are not the same as 
the maximum ISS potential measured by the FPMU at eclipse exit. Discrepancies between the 
measured data and PIM3.0 modeled data show that there are deficiencies in the model and use of 
FPMU data that limit the accuracy of the output. These limitations and sources of error need to 
be identified, documented, and communicated to the critical decision makers as part of meeting 
the NASA-STD-7009 Standard for Models and Simulations requirements [NASA, 2013a]. 

The NESC team identified a number of limitations and sources of error in PIM3.0, which 
resulted in discrepancies between measured and modeled data. Fundamental issues with the 
physics-based algorithms used in the code include: 

• Analytical approximations used in the numerical solutions for the potential barriers in the 
gaps between solar cells (solar array electrical current collection model). 

• Assumption that every solar cell and solar array string collects the same electrical current. 

• Use of a static (equilibrium) charging algorithm independent of ISS capacitance that 
cannot predict rapid charging events. 

• Use of single capacitance in time-dependent charging algorithms that oversimplifies the 
physics of ISS charging and fails to model fast transient charging (i.e., rapid charging 
events). 

The issue with the charging algorithms included in the PIM3.0 charging model is fundamental to 
whether the code will be able to predict the full range of charging behavior observed on the ISS. 
PIM3.0 in its current state is only capable of modeling the relatively slow change in ISS potential 
at eclipse exit, but fails to correctly model the rapid charging events observed at eclipse exit and 
when solar arrays are unshunted in sunlight. Refer to Section 7.6. 

In addition, errors in input data used to run the model or configuration data used to constrain the 
ISS electrical current collection processes will also impact the model results. A number of these 
errors include: 
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• Uncertainties in FPMU Ne and Te input data (due to FPMU data reduction errors). 

• Timing of FPMU data chosen for the PIM3.0 charging model input relative to the 
charging peak maxima. 

• Errors in knowledge of (or values used for) solar array angles, ISS flight attitude, ISS 
velocity. 

• Variations in ion collection area (free parameter adjusted to obtain best results). 

While it may not be necessary to fully characterize each of these sources of error in the PIM3.0 
charging model output, an error bound at some appropriate statistical level should be computed 
and applied to the PIM3.0 charging model output when used in safety assessments. 

Reference: 

1. NASA (2013a): NASA-STD-7009 Standard for Models and Simulations, July 10, 2013. 

7.4 PIM3.0 Charging Model in the Critical Path to EVA 

The Columbia Accident Investigation Board report [CAIB, 2003] and NASA’s response to it, 
contained in the “A Renewed Commitment to Excellent” report [NASA, 2004], both emphasize 
that modeling and simulation (M&S) used as a basis for critical decisions must meet certain 
standards to ensure the credibility of the results and that analytical results derived from M&S are 
assessed and properly conveyed to those making critical decisions. NASA responded to the 
findings in CAIB, 2003 and PB2005- 10096, 2004, by establishing a minimum set of 
requirements and recommendations for use of M&S to support critical decisions and published 
them in NASA-STD-7009, 2013. The requirements and recommendations contained in the 
standard are intended to address one or more of the following eight objectives: 

1. Identify best practices to ensure that knowledge of operations is captured in the user 
interfaces (e.g., users are not able to enter parameters that are out of bounds). 

2. Develop a process for tool verification and validation, certification, verification, 
revalidation, and recertification based on operational data and trending. 

3. Develop a standard for documentation, configuration management, and quality 
assurance. 

4. Identify any training or certification requirements to ensure proper operational 
capabilities. 

5. Provide a plan for tool management, maintenance, and obsolescence consistent with 
M&S environments and the aging or changing of the modeled platform or system. 

6. Develop a process for user feedback when results appear unrealistic or defy explanation. 

7. Include a standard method to assess the credibility of the M&S presented to the decision 
maker when making critical decisions (i.e., decisions that affect human safety or mission 
success) using results from M&S. 

8. Assure that the credibility of M&S meets the project requirements. 

NASA-STD-7009 defines a critical decision as "those technical decisions related to design, 
development, manufacturing, ground, or flight operations that may impact human safety or 
mission success, as measured by program/project-defined criteria. ” A decision to discontinue 
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the use of PCUs as a redundant hazard control to guard the safety of crew members during EVA 
(based on the results of the plasma hazard forecasts and PIM3.0 modeling of ISS shock hazards) 
meets the NASA-STD-7009 definition of a critical hazard. However, the PIM3.0 charging 
model, when used to provide results in support of a critical decision, falls short of the 
requirements and recommendations contained in the NASA-STD-7009 in almost every regard. 
Examples of the more serious PIM3.0 shortcomings include (but are not limited to): 

• The limitations of the PIM3.0 are not explicitly known by the decision makers. 

• User’s manual and parameter definitions for the PIM3.0 code are not available. 

• The configuration files that provide the PIM3.0 model input and control how the model is 
run are not documented in the pre-planning proposed procedure. No documented process 
exists to constrain the content of the configuration files assuring the model is used the 
same every time it is run. 

• The model has not been independently peer reviewed. 

• There is no process identified to update the PIM3.0 charging model to include physical 
changes to the station configuration. 

• There is no clearly documented validation, verification, or certification process. 

• Uncertainty in the model results are not documented and applied to model output. 

The NESC team finds that the PIM3.0 charging model should not be in the critical path for EVA 
safety decisions as it lacks the pedigree associated with NASA standards for M&S. 

References: 

1. CAIB (2003): Columbia Accident Investigation Board, Volume 1, August 2003. 

2. NASA (2004): A Renewed Commitment to Excellence: An Assessment of the NASA Agency- 
wide Applicability of the Columbia Accident Investigation Board Report, PB2005- 100968, 
January 2004. 

7.5 Example of PIM3.0 Error Estimate 

Results from the PIM have been stated and used with a high level of accuracy. Sometimes 
PIM3.0 results are reported to the tenth of volt and in some cases reported to the hundredth of 
volt. Kramer et al. (2010) [Kramer, et ah, 2010] in a contributed paper to a conference state that 
“The EVA worksite voltage exposure, as seen in Figure 6 and Figure 9, using Boeing-developed 
capability incorporated into the PIM3.0 is accurate.” The authors attribute any error in the 
PIM3.0 results on inputs to the model. No evidence of PIM3.0 validation is referenced for their 
statement. No evidence of a validation exercise has been provided to the NESC team. In a 
hazard situation (e.g., the EVA scenario), statements implying “no error” should be regarded 
with skepticism. Scatter plots of PIM3.0 and FPMU visually do not support using PIM3.0 
results to an accuracy of 0.1V. This note is to derive an error based on available PIM3.0 results 
as compared with FPMU data. The result of this method is not offered as the final value, but as 
motivation for the ISS Environments team to derive a value that is vetted and approved within 
the ISSP. 


NESC Request No.: TI-13-00869 


@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

13-00869 

Version: 

1.0 

Title: 

ISS PCU Utilization Plan Assessment Update 

Page #: 

46 of 225 


Figure 7.5-1 shows a scatter plot of PIM3.0 versus FPMU data. The time period that spans the 
data is day 188 of 2007 to day 105 of 2013. For each FP measurement of the FPMU, the 
simultaneous FPMU density and temperature measurements were input to the PIM3.0 with 
output calculation appropriate for the FPMU location. Note this data period includes both 
locations of the FPMU on the truss (i.e., SI Truss from August 3, 2006, to November 21, 2009, 
and the PI truss from November 21, 2009, to the present). The number of data points is 2164. 
Comparing charging events included the fde used to generate Figure 7.5-1 [Boeing, 2013] with a 
Marshall Space Flight Center (MSFC) study of eclipse exit charging events [Wright, et ah, 

2009], the NESC team detennined that not all of the rapid charging events are included in the 
Boeing, 2013 data set. Nevertheless, fundamental infonnation about an error bar to associate 
with a PIM3.0 calculation can be obtained from this data set. 

Figure 7.5-2 shows a plot of the difference between the PIM3.0 calculations and the FPMU FP 
measurement versus the FPMU measurement. As noted in the figure, ~74 percent of the data 
show a positive difference. Note that the values shown in Figure 7.5-1 are negative. A positive 
difference indicates that the PIM3.0 calculation is less negative, meaning that the model is 
underpredicting the FP of the ISS frame. In a hazardous situation (e.g., EVAs are treated), 
underpredicting should be viewed with concern. 



Figure 7.5-1. Scatter Plot of PIM3.0 Voltage Calculations versus FPMU FP Measurement. The 
dashed line represents a one-to-one correspondence; i.e., a slope of 1. 
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Figure 7.5-2. Plot of the (PIM3. 0 calculation - FPMU Measurement) Difference versus FPMU FP 
Measurement. Dashed line indicates no difference between the model and measurement. 

To get an idea of error from the PIM3.0 calculations, the distribution of occurrence of the model- 
measurement difference data was plotted. The histogram (blue line) in Figure 7.5-3 shows the 
number of occurrences in IV bins versus the PIM3.0 calculation-FPMU measurement difference. 
Overlaid on the histogram is a Gaussian curve (dashed red line) defined in Eqs. (1) and (2). 

Gaussian = A 0 exp' (z * z)/2 , where Eq. (1) 

Z = (x-AO/Aa Eq. (2) 

A 0 was chosen to match the largest amplitude of the distribution. Ai was chosen to match the 
location of the peak in the distribution. A 2 is the standard deviation and was determined by 
requiring that 68 percent of the distribution lie within one standard deviation of A[. Visual 
examination of the distribution (blue curve) indicates that it is not quite Gaussian in shape. The 
exercise here is to demonstrate a non-zero error and the use of a Gaussian distribution is 
sufficient to do this. 
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Figure 7.5-3. Histogram of PIM3.0, FPMU Measurement Difference for 1 V bins. The red-dashed 

line overlay is a Gaussian curve- fit. 

Figure 7.5-4 shows how the data points fall into the 1-, 2-, 3-, and beyond 3a bands. The various 
data bands are colored-coded. The 2.5V difference bias in the data is denoted as the dashed line. 
The various rapid charging event data points are not known with certainty in this plot, but it is 
speculated that these events are the points denoted in red that lie outside the 3 a band and solicit 
inclusion in an updated PIM. 
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Figure 7.5-4. Data in Figure 7.5-2 re-plotted with color code to indicate points that lie inside l-o . ; 

2 -a, and 5-<r boundaries and also points that lie beyond the 3-cr boundary. The dashed line is the 

2.5V bias inherent in the PIM. 

A suggested method to use for the purpose of deriving a FP value calculated by PIM3.0 is the 
following. First, consider the data plotted in Figure 7.5-5 as FPMU versus PIM3.0 calculation. 
The y-axis in this case could be considered a “prediction.” The data were curve-fit to Eq. (3). 

Y = A + B*X, with Eq. (3) 

A = -7.89 and B = 0.67 

The best linear fit is marked by the black line. Also shown in Figure 7.5-5 are the 1-a (±4V) 
boundary lines and the 2-a (±8V) boundary lines drawn parallel to the best linear lit line. 

If a plasma environment (i.e., density and temperature) is input to PIM, then a calculated value 
for a particular location is detennined. This calculated value should be processed through 
Eq. (3) to obtain a corrected value. Note the difference between the black centerline and the 
green la boundary lines for a given PIM3.0 value approximately ±3V. Once the corrected 
PIM3.0 value is obtained, an error of ±3V for the la case should be assigned. In considering the 
2a case, an error of ±6V should be assigned. The risk posture of the ISSP should determine what 
amount to include of standard deviations. 


i i i i i i i i i i r 
BLUE: +/- 1-SIGMA (68%) 

GREEN: +/- 2-SIGMA (94%) 

PURPLE : +/- 3-SIGMA (97%) 

RED: outside 3-SIGMA (100%) 
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Figure 7.5-5. FPMU versus PIM3.0 calculation. The y-axis can be interpreted as a prediction 

based on a given environmental input. 

Recommendation: The ISS Environments team should obtain a voltage error to assign to any 
PIM-calculated value and refrain from stating such calculated values to an accuracy of less than 
IV. 

References: 

1. Kramer, L.; Hamilton, D.; Mikatarian R.; Thomas J.; and Koontz, S. (2010): “Positive 
Voltage Hazard to EMU Crewman from Currents through Plasma,” Proc. 4 th IAASS 
Conference ‘Making Safety Matter ’ , Huntsville, Alabama, USA, 19-21 May 2010 (ESA SP- 
680, September 2010). 

2. Boeing (2013): PIMVarl_results.xls fde, 2013a. 

3. Wright, et al. (2009): Wright, K.H., FPMURapidChargingEvents_KHW_2009Mar02.xls file, 
2009. 

7.6 Types of Charging Events 

Figure 7.6-1 shows examples of the three basic types of negative charging events, due to solar 
array interactions with the plasma environment, which have been identified in FPMU data. The 
PCU was not operating during any of the charging events shown in the figure and the potentials 
refer to the ISS potential measured by the FPMU floating potential probe at the location of the 
FPMU instrument. Voltages at other locations on the truss will be shifted by the appropriate 
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v x B • L inductive potential at the time the data was obtained. Potentials due to normal 
charging (Figure 7.6- la) are generally in the range of -20 V to -30V, but the duration of the 
charging events may last for many minutes to 10s of minutes [Wright, et ah, 2007]. Normal 
charging is the most commonly observed type of ISS eclipse exit charging event. 
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Figure 7.6-1. ISS Solar Array Charging 

Charging events identified to date due to solar array interactions with the plasma environment, 
include (a) normal eclipse exit charging, (b) eclipse exit rapid charging events, and (c) rapid 
charging events in sunlight following array unshunt operations. 
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Rapid charging events at eclipse exit (Figure 7.6- lb) are characterized by increases in potential 
over time scales of seconds followed by a rapid decrease in potential over a few seconds. While 
many rapid charging events remain within the -20 to -40V range, some of the largest eclipse 
exit charging events observed on the ISS have been rapid charging events with potentials in the 
-40 to -67V range [Craven, et ah, 2009; Minow, et ah, 2010]. Rapid charging events are less 
common than normal charging, and appear to be correlated to eclipse exit conditions with low 
plasma densities (less than 3 x 10 10 m°) [Craven, et ah, 2009]. 

Finally, a class of rapid charging events (Figure 7.6- lc) occur when fully shunted solar arrays are 
unshunted in full sunlight [Minow, et ah, 2010]. Sunlight unshunt rapid charging events are 
transient events reaching the maximum potential within one FPMU sample period 
(<7.8 milliseconds (msec)) followed by a rapid decrease in potential on times scales of 20 to 
150 msec. Sunlight unshunt rapid charging events were first observed on GMT 2010/155 and 
over the period GMT 2010/205-212 during a set of 36 experiments in which all 8 ISS solar 
arrays were fully shunted for about 3 minutes following eclipse exit. Then each array wing was 
unshunted at 1 -second intervals resulting in a set of eight charging peaks (Figure 7.6-2). Two 
additional events were observed on GMT 2013/130 when array power manipulation activities 
associated with the ammonia pump repair required shunting the 2B array and unshunting in 
sunlight. The largest recorded ISS negative charging events fall in this category. Maximum 
potentials for 288 of the 289 sunlight unshunt rapid charging event charging peaks observed to 
date are more negative than -45V, 265 events are more negative than -60V, and 16 events are 
more negative than -90V. Two charging events on GMT 2010/209 reached -95V and are the 
largest negative charging events observed to date on the ISS. Sunlight unshunt rapid charging 
events have been observed in all cases where FPMU data is available following unshunt of a 
solar array in sunlight. 
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Figure 7.6-2. Detail of Sunlight Unshunt Rapid Charging Event 

The time scale for the sunlight unshunt rapid charging event from Figure 7.6-1 is expanded to 
better show the rapid rise time and decay of each of the eight events. Rise time from background 
to maximum potential is <7.8 msec and the charging peaks decay within —100 msec. The array 
responsible for each charging peak is indicated and the highest negative charging observed to date 
on the 1SS are the events from the 3B and 4B arrays. 

Figure 7.6-3 provides a summary of the ISS eclipse exit charging levels and examples of the 
most extreme negative and positive charging events observed to date. PCUs were off for all of 
the events in the summary so it provides examples of the range of charging that can be observed 
when PCUs are not used to control the vehicle potential. The figure and analysis of the data used 
to generate it highlights three important findings. First, ISS charging is variable with 
approximately 95 percent of the observed charging events remaining within 0 to -45V. Second, 
FPMU data provide a record of a number of ISS charging events more negative than -45 V 
contradicting the ISS-NCR-232G that states “ FPMU measurements since 2007 have indicated no 
ISS charging in excess of -45V.” Third, positive potentials are not due solely to PCU operations 
so discontinuing use of the PCUs will not eliminate exposure to positive potentials. 
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Time (UT) 


Figure 7.6-3. ISSFPMV Charging Event Summary 
(Top Panel) Colored symbols indicate the maximum potential in individual charging events as a 
function of time. (Bottom Panel) The FI 07 index is a measure of the solar 10.7 cm radio flux (in 
solar flux units) showing the phase in solar cycle. 

The majority of the data points in Figure 7.6-3 are from a Boeing study [Boeing, 2013] of the 
maximum negative ISS frame potential due to solar array charging following eclipse exit. The 
data cover 2,164 orbits during the period starting 2007/188 through 2013/105. The ISS potential 
measurements at the FPMU location are adjusted for the v x B • L potential difference between 
the measurement location and the ISS centerline (black symbols), starboard Truss tip (red 
symbols), and port truss tip (blue symbols). 

The Boeing data were checked against a MSFC study of rapid charging events during the period 
from 2007/027 through 2009/037 [Wright, et ah, 2009] to determine if all rapid charging events 
more negative than 45 V in the MSFC study are in the Boeing data set. Seven events were 
identified that exceed -45V (green symbol) that are missing from the Boeing study. These 
values are from the original location of the FPMU on the starboard Truss and have not been 
adjusted by the v x B • L potential to the locations used in the Boeing study. However, they can 
be directly compared because all seven events occur near the geographic equator where v x B • L 
effects along the Truss are small. A total of 2,171 eclipse exit charging events are available 
including the 2164 from the Boeing 2013 study [Boeing, 2013] and the seven additional events 
from Wright, et al. 2009. Table 7.6-1 provides a summary of the eclipse exit charging events 
from these studies providing the number of events more negative than -45V and the number of 
events more positive than 0V. 
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Figure 7.6-3 also includes all 287 of the sunlight unshunt rapid charging events (yellow symbols) 
from the 2010 solar array charging experiments and the two on GMT 2013/130 during the 
ammonia pump repair activities. Charging events more negative than -45 V are summarized in 
Table 7.6-1. Two important points regarding sunlight unshunt rapid charging events are worth 
emphasizing: (1) the FDIR process currently used to protect the crew in case of a PCU failure 
during an EVA automatically shunts all eight solar arrays if one of the PCUs is not operational, 
and (2) the ISS can operate on batteries for only a limited amount of time. Ground control will 
have to unshunt a subset of the arrays to restart the solar array electrical current collection 
sometime after the FDIR has been activated. Present flight rules provide no guidelines on when 
to unshunt the arrays, so there is a risk the operation could be implemented in sunlight, and 
expose the EVA crew to the large sunlight unshunt rapid charging events. Developing a new 
flight rule to require the array unshunts to be implemented during night or discontinuing use of 
the FDIR will eliminate this risk. 

Finally, transient positive charging events were also observed on the ISS with maximum 
potentials often reaching some 10s of volts. Figure 7.6-4 shows examples of three positive 
charging events from GMT 2010/208. The largest event exceeded 0V for over 200 msec, 
reaching a maximum potential of approximately +55V. This is the largest positive charging 
event that has been identified in the FPMU data to date. Additional examples of four transient 
positive charging events can be seen in Figure 7.6-lc. Maximum potentials from 21 positive 
charging events (orange symbols) are included in Figure 7.6-3 and Table 7.6-1, including the 
record event from GMT 2010/208. No attempt was made to identify all positive charging events 
in the FPMU data records. The values shown in Figure 7.6-3 only provide examples for the 
range of positive potentials that have been seen on a few dates. The ISS environments 
community currently has no explanation for origin of these events. It is worth noting, however, 
that discontinuing use of the PCUs will not protect an EVA crew from the transient positive 
charging events since the examples included in Figures 7.6-3 and 7.6-4 were all observed when 
the PCUs were not operating. 
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Figure 7.6-4. Positive Charging Events 

Example of the positive charging events including the largest observed to date reaching 
approximately +55V. 


Table 7.6-1. Charging Events > 0 and < -45V 


Study, location 

All 

Events 

Events < -45V 

Events > OV 

Boeing, starboard 

2164 

8 

50 

Boeing, port 

2164 

27 

77 

Boeing, center 

2164 

1 

0 

Wright et al., FPMU starboard 

7 

7 

0 

Sunlight unshunt, FPMU port 

289 

288 

0 

Positive transients 

21 

— 

21 


The NESC team emphasizes that Figure 7.6-3 does not represent a complete record of all 
charging on the ISS or even a carefully designed statistical study of ISS charging using a subset 
of eclipse exit charging data. The ISS potentials are available only when FPMU is operating and 
data are available through live telemetry downlink. The period starting 2007/188 through the 
end of 2013/105 represents approximately 33,1 17 ISS orbits (based on orbit numbers between 
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the first two-line element set on 2007/188 and the first two-line element set on 2013/106). Only 
2,171 eclipse exit charging events are included in the study from this period, which is 
approximately 6.6 percent of the orbits during the study period. 

FPMU operation periods are selected for the engineering purpose they support including PCU 
operation verification, PIM3.0 charging model studies, plasma hazard analysis for EVA, 
verifying charging contributions due to visiting vehicles, payload science support, international 
ionosphere World Day periods, and space weather charging studies. No attempt was made to 
optimally distribute the FPMU operations to best sample the widest range of eclipse exit 
conditions in order to obtain a statistically unbiased set of charging data. 

Figure 7.6-5 is the first example of auroral charging observed on ISS. The event was captured 
while the FPMU was running in support of Space Transportation System- 123 mission activities 
at the ISS and automated transfer vehicle docking operations. This charging event cannot be due 
to solar array electrical current collection because the arrays are not biased at night. Night 
charging events on the ISS typically are observed at high latitudes during geomagnetic storms 
consistent with an auroral electron source for the charging currents. 
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Figure 7.6-5. ISS Auroral Charging 

Two ISS orbits showing short periods of solar array charging at eclipse exit and entry 
superimposed on the v x B • L potential oscillation due to the motion of ISS across the Earth’s 
magnetic field. The -37V charging peak just before 08:00 UT is auroral charging at high northern 
latitudes in the middle of the night. This was the first and to date the largest auroral charging event 
observed on ISS. 
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Auroral charging of the ISS vehicle chassis is well-controlled by the PCUs since they are capable 
of discharging currents up to 10 amps while extreme auroral electrical current densities are 
typically on the order of 10' 5 ampere per meter-squared (A/m) 2 to 10' 4 A/ 111 2 [Cho, et ah, 2012]. 
Electrical current collection from the most extreme auroral conditions should not exceed the 
capability of the PCUs to discharge the charging current because most of ISS is covered by 
insulating materials with a relative small area of conductor exposed to the space environment. 

For this reason, auroral contributions to the ISS frame charging have never been considered a 
risk for EVA as long as the PCUs are operating. 

However, the situation is quite different if the plasma hazard forecast process is used instead of 
the PCUs to protect the crew from arcing hazards during EVA because auroral charging cannot 
be predicted using the IRI model and PIM3.0 analysis. IRI is a climatology model which only 
treats the low energy (~0. 1 eV) charged particles that comprise the bulk of the ionosphere 
plasma, but does not provide information on the currents of high energy (~ 1000s to 10,000s eV) 
electrons responsible for auroral charging. Even if the auroral particle flux information was 
available, the PIM3.0 does not include a module for incorporating the contributions of auroral 
currents to ISS charging. A decision to discontinue PCU use for protecting EVA astronauts from 
arcing hazards in favor of the plasma hazard forecast process will leave the crew exposed to 
negative charging hazards due to the ISS frame charging by the aurora. 

Figure 7.6-5 is not only the first auroral charging event observed on the ISS, but is also the 
largest. The ISS potential increase due to the auroral electron current is more negative by about 
17V than the background -20V due to v x B • L. In this case, the net charge at the location of 
the FPMU where the charging was measured is -37V, which does not exceed the -45.5V limit. 
However, a similar - 17V charging event would result in violations of the -45.5V safety limit for 
any part of the ISS structure with a potential more negative than -28V. Such a violation might 
occur, for example, when the ISS exits eclipse at high latitudes where aurora is present such that 
auroral charging is coincident with the eclipse exit charging. It can be estimated what kind of 
conditions might lead to these safety violations by consulting the data set used to generate Figure 
7.6-3 to see how often charging events with potentials of -28V or more have been observed. 
There are 55 eclipse exit charging events with negative potentials more negative than -28V at 
the ISS centerline; 444 more negative than -28V at the ISS port Truss tip and 760 more negative 
than -28V at the ISS starboard Truss tip. Each of these events would result in potentials on the 
ISS reaching or exceeding the -45V safety limit. No analysis has been presented by the ISSP to 
evaluate the risk trade involved in discontinuing the use of PCUs, which currently control this 
risk and using the plasma hazard forecast process that is incapable of predicting auroral 
charging threats. 

While - 17V was used in the preceding discussion, there is no reason at this time to believe that 
auroral charging could not result in higher potentials. Sampling of auroral charging by FPMU 
has not been extensive due a number of factors. First, FPMU is operating only in campaign 
mode for limited amounts of time so auroral events may be missed. There has been some effort 
in recent years to target FPMU operations to capture auroral charging data [Minow, et ah, 2010, 
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2012; Minow and Parker, 2013], but there are still geomagnetic storm periods that are missed 
due to constraints on operation of the instrument. Second, there is a sampling bias due to the 
position of an ISS orbit relative to the location of the aurora. Even during geomagnetic storm 
periods when aurora moves closer to the equator, the ISS may not encounter the aurora because 
there is a local time dependence on the maximum magnetic latitude along the orbit where aurora 
is more likely to be encountered. If the highest magnetic latitudes along the orbit are not at the 
right longitude, then the ISS is unlikely to encounter strong auroral electron particle flux 
regardless of the strength of the aurora. Finally, auroral activity sampled since FPMU started 
operations on the ISS has not been that strong because FPMU started operations in late 2006 as 
the last solar cycle was ending, through the geomagnetic quiet period between the previous and 
current solar cycle, and through the current relatively low activity solar cycle. The result is that 
only nine periods during geomagnetic storms with auroral charging have been observed through 
April 2013 [Minow and Parker, 2013] with one or two additional periods observed later in 2013. 
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7.7 Estimate of Likelihood of Auroral Charging for ISS 

As discussed in previous inputs to the ISS EVA Charging Study, the aurora have been observed 
to cause charging of bodies in low altitude orbit from - 100 to -2,000V. Such charging events 
are relatively infrequent, as discussed below. However, the events are typically of short duration 
(e.g., -10 seconds to 1 minute typically) and up to 3 minutes on one occasion (Minow, private 
communication). Solar lighting, seasonal variations in the ionospheric density, geomagnetic 
activity, and plasma wake shadowing are known to contribute to the event likelihood. For 
EVAs, the main requirements are the presence of the ISS in the auroral zone, the encounter with 
an auroral arc, and the shadowing (i.e., from sunlight and the ionospheric plasma) of the 
astronaut. One method to estimate the probability of the astronaut experiencing an auroral 
charging event is a Monte Carlo simulation taking into account these variable conditions. 
However, for the purposes of this assessment, such a detailed analysis is not appropriate. Rather, 
a first order estimate on the upper limit of the hazard was derived. 

Upper Bound on Auroral Charging Hazard 

As shown in Figure 7.7-1 [Evans, 2012], the auroral zone forms a roughly ellipsoidal pattern 
around the Earth’s magnetic poles oriented in local time. The maximum probability of 
encountering an auroral arc (assumed here to occur in the form of roughly longitudinal arcs 
-60 km in latitudinal thickness) is 0.01 (for a 1-degree x 8-arc minute bin in Figure 7.7-1) near 
65 degrees geomagnetic latitude and 2 1 hours local time. The equatorward extension of the 
auroral zone is -60 degree-geomagnetic. This corresponds to geographic latitude of -49 degrees 
as the Earth’s magnetic field is inclined ~1 1 degrees to the geographic pole. Thus, the ISS needs 
to be both poleward of -49 degree-geographic latitude and approximately in the longitude 
sectors near —70 degrees W (North Pole) and -1 10 degrees E (South Pole). This “auroral 
charging” region, in geomagnetic coordinates, is marked by the red ellipse in Figure 7.7-1. 

Figure 7.7-2 [Anderson, 2005] shows the locations of observed Defense Meteorological Satellite 
Program (DMSP) auroral charging events superimposed on the ISS orbit (Note: the DMSP data 
are skewed because of various data collection and temporal selection issues) in geographic 
coordinates — the blue rectangles mark the approximate regions of ISS charging. A simple 
estimate of the ISS orbit indicates that it has a probability of -0.16 to 0.18 of being poleward of 
49 degrees for a given orbit. A similar analysis gives a fractional probability of -0.13 for the ISS 
to be within the longitude range of the auroral zone. Since the two events are independent of 
each other, the probability of being in the auroral charging region is given by the product of their 
respective probabilities. That is, the ISS will likely “on the average” encounter the lower edge of 
the auroral charging zone with a probability, Pe, of (0.13 x 0.16 =) -0.02 during an orbit. 

Further, Evans estimates that at least one 10-second duration active auroral arc will be 
encountered with a probability of 0. 1 for a single orbit crossing the auroral zone [Evans, 2012]. 

Since the ISS skirts the equatorward edge of the auroral zone rather than passing through it, it is 
assumed that a more conservative estimate of the probability, Pac, of encountering a 10-second 
duration arc would be between 0.0001 to 0.001 for a single ISS passage through the auroral zone 
based on Figure 7.7-1. 
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Figure 7. 7-1. Absolute probability of encountering a large energy flux event/aurora as a function of 
corrected geomagnetic latitude and local time for a satellite. Latitude scale is from 45 to 90 degrees 
magnetic [Evans, 2012]. The red ellipse marks the approximate region where one would expect to 

see 1SS charging. 



Figure 7. 7-2. The 1SS orbit track over 24 hours and the locations (red) of DMSP charging events of 
less than -100V [Anderson, 2005]. The rectangles mark the approximate regions where one would 

expect to see 1SS charging. 


If an EVA were ~6 hours, then that would be ~4 orbits. Assuming that the ISS will encounter 
the auroral zone twice (North or South) during a single orbit, the total probability, P T , for 4 orbits 
would be given by Pt = Pe*(1-(1-Pac) 2 * 4 ) ~0.02*2*4*P A c for a probability of Pt ~ 1.6 x 10' 5 to 
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1.6 x 10' 4 for an arbitrary 6-hour EVA. Mitigating this concern, however, would be the 
previously mentioned issues of the astronaut being in both sunlight and plasma shadows. The 
solar wind conditions can be used to give up to a 40-minute warning of pending auroral activity 
or the use of Kp (or even “looking out the window” to see if aurora are in progress) to either 
terminate or abort an EVA further limiting the threat of auroral charging. 

Conclusion 

While it is strongly encouraged to carry out a much more thorough “Monte Carlo” analysis of the 
likelihood of encountering a 10-second duration auroral arc, the preceding estimates put an upper 
bound on the probability of 1.6 x 10’ 5 to 1.6 x 10‘ 4 for a 6-hour EVA. Seasonal, solar cycle, and 
“shadowing” issues will further significantly change the estimate — the latter requirement for 
“shadowing” will greatly reduce the number, but currently there is no way to estimate that factor 
as it is “mission-dependent.” Finally, terminating or avoiding EVAs based on forecasting or 
monitoring of auroral conditions could be used to further limit the concern of auroral charging. 
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7.8 PCU Capability to Maintain the ISS Near to Space Plasma Potential 

7.8.1 PCU IV Characteristic versus FP Mitigation 

The PCUs make EVA safer for the astronaut under negative conditions including rapid charging 
events and frame charging due to aurora. The discussion below shows that the PCU has the 
ability to maintain the ISS chassis potential within 15V of the local space plasma for all 
conceivable conditions because the plasma contactor can emit electron currents two orders of 
magnitude greater than the largest emission currents observed to date on the ISS. The PCU is 
capable of emitting currents greater than the sum of all possible plasma currents to the station, an 
extreme “worst-on-worst” upper bound. The PCU is capable of controlling the ISS potential for 
all planned future ISS configurations. 
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The maximum electron current that the ISS could possibly collect is when all the array surfaces 
were facing the ram in the highest density ionosphere and the total array solar cell area were 
collecting as if it were entirely exposed conductors. This is an extreme upper bound because the 
solar cells top surfaces are insulating cover glass. The solar array has eight wings, with each 
wing having two flexible blankets with solar cells. The blankets consist of 82 live panels with 
200 8-cm x 8-cm cells. Thus, the mathematical upper bound on the electron collecting area is 
less than 1700 m 2 . 


The electron thermal current, j t h, is a function of the plasma electron temperature, T, and 
density, n: 


Jth( n , T ) : = e chnrge-n- 


® charge * -f 

2 • 7T • m e 


where m e is the electron mass and e c har ge is the charge on an electron. The electron current 
collected in worst-case ionosphere environment is around 20 ampere (A). 

n e := 1 • 10*“ m 1 
T e :=0.2 V 

j:=jth(n e ,T e ) = 0.012 A- 
m 

T =90 4 

* array* J array 


This is an unrealistically high worst (maximum collecting area) on worst (maximum electron 
current density) upper bound on the electron current. This upper bound is almost 40 times larger 
than the largest PCU currents observed to date, 0.575 A PCU 1 + PCU 2, measured on orbit 
[Koontz, 2013 private communication]. 

Prior to flight, the plasma contactor hollow cathode was subject to a 28,000-hour life test in a 
vacuum chamber [Sarver-Verhey, 1997]. The test was conducted at 12A emission current. As 
shown in Figure 7.8-1, the PCU I-V trace is essentially vertical at 10A. Hollow cathodes of 
essentially the same design are qualified for and routinely run in electric propulsion thrusters at 
more than 13 A continuous emission current. For brief periods, several minutes at a time, the 
PCU hollow cathode is able to emit more than 20A without damage (Goebel 2 ). 


“ Goebel, Dr. Dan, JPL Hollow Cathode Expert. 
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Figure 7.8-1. Plasma Contactor Emission Current Measured in a Ground Test Chamber as a 

Function of Voltage 

The NESC team’s conclusion is that PCU is capable of emitting orders of magnitude greater 
electron currents than has been needed to date on the ISS and that the device is capable of 
handling the even worst-case upper bound electron currents from worst-case environments. 

References: 

1 . Koontz, Steve (20 1 3): “PCU_emission_currents_20 1 0_through_20 1 3 .xlsx,” private 
communication. 

2. Sarver-Verhey, T.R. (1997): “28,000 Hour Xenon Hollow Cathode Life Test Results,” IEPC- 
97-168, 25 lb International Electric Propulsion Conference, Cleveland, Ohio, August 24-28, 
1997. 


7.8.2 PCU Operational Life 

The on-orbit PCUs both satisfy the two necessary conditions for long life. First, both PCUs have 
enough xenon to last well past 2028. The chart in Figure 7.8-2 from “Plasma Contactor Unit 
(PCU) - Status,” [Kaminski and Scudder, 2013] was used to estimate that each EVA uses about 
65 gram (gm) of xenon. 
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PCU Xenon Consumable Remaining 2028 Projections 



Figure 7.8-2. Xenon Usage Projections 

Kaminski and Scudder’s lowest estimate of remaining xenon is that PCU2 may have 37 pounds 
remaining in the tank, about a pound less than shown in Figure 7.8-2. Based on the charts in that 
presentation and the worst-case assumption of 14 EVAs per year, the remaining xenon will last 
an additional 1 8 years, or through 203 1 . In the calculation below, the xenon mass used for an 
EVA, Meva, is estimated from the slope in Figure 7.8-2. Mpcu2 is the estimated mass of xenon 
remaining in the PCU2 tank. 

M fva ~ - 2 ° lb =0.065 kg 
^ 10-14 y 


MpcU2 := 36.93 lb 


MpcU2 

14 

— ‘M eva 
yr 


= 18 yr 


The second requirement is that the PCU hardware, in particular the hollow cathode assembly, has 
sufficient life to process the xenon remaining in the tank. The low side of the nominal xenon 
flow rate is 6 standard cubic centimeters per minute. The lowest rate can be chosen because it 
requires the longest hollow cathode life. 
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m (io( :=6.0 CTn Loschmidt • m Xe = O.G Trl iL 
min s 

From this, calculate the total time per EVA that the plasma contactor is operated. 

W =JAi =:i l hr 

m dot 

From Figure 7.8-2, it is estimated the PCU 1 was loaded with 48 kilograms of xenon. The PCU 
would have to operate for 22,000 hours to process that much xenon. 

ii*£ = 22597 hr 

m dot 

The plasma contactor hollow cathode assembly was qualified prior to flight with a 28,000-hour 
life test in a vacuum chamber [Sarver-Verhey, 1997]. Since then, similar hollow cathode 
assemblies have operated for long periods without any difficulty. The NASA Solar Technology 
Application Readiness (NSTAR) ion thruster has two similar cathodes. The NSTAR Extended 
Life Test was run for 30,000 hours before ending due to programmatic constraints [Sengupta, 
et ah, 2004]. During the Deep Space 1 flight mission, the NSTAR thruster accumulated 16,265 
hours before the mission ended [Rayman, 2003]. The neutralizer hollow cathode used on the 
NASA Evolutionary Xenon Thruster (NEXT) ion thruster is the same design as the ISS PCU. 

The NEXT thruster recently successfully completed a 48,000-hour life test [NASA, 2013b]. 

This is more than twice the worst-case required hollow cathode life. 

References: 

1. Kaminski, R.; and Scudder, M. (2013): Boeing ISS EPS, September 2013. 

2. Sarver-Verhey, T.R. (1997): “28,000 Hour Xenon Hollow Cathode Life Test Results,” IEPC- 
97-168, 25 th International Electric Propulsion Conference, Cleveland, Ohio, August 24-28, 
1997. 

3. Sengupta A.; Brophy J.R.; Anderson J.R.; and Garner C. (2004): “An Overview of the 
Results from the 30,000 Hour Life Test of the Deep Space 1 Flight Spare Ion Engine,” AIAA 
Paper 2004-3608, 40 ,h Joint Propulsion Conference, Ft. Lauderdale, Florida, July 1 1-14, 
2004. 

4. Rayman, M.D. (2003): “The Successful Conclusion Of The Deep Space 1 Mission: 

Important Results Without a Flashy Title,” Space Technology 23, Nos. 2-3, p. 185, 2003. 

5. NASA (2013b): Press Release 13-193 “NASA Thruster Achieves World-Record 5+ Years of 
Operation.” June 24, 2013. 

7.9 EMU Exterior Metal Parts 

This section summarizes the EMU (U.S. suit) exterior metal parts that may pose an entry point 
into the astronaut’s body either by direct contact with a charged metal surface (of the ISS) or a 
plasma contact so that two of them can cause or permit electrical current flow in the astronaut’s 
body. 
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Table 7.9-1 lists the name, material, coating/covering, isolation ohms, probability of failure and 
comments for every entry point. The table title permits listing a material (i.e., stainless steel or 
Al) and a coating (e.g., anodize or paint or uncoated stainless steel), but that information is 
difficult to find and is not listed here. 

It can be seen in Section 7.10 that the specific materials are not used in the calculations and they 
are not listed in Table 7.9-1. 

Table 7.9-1 contains word descriptions of the relative importance of the various items 
listed. Refer to Figures 6.3-9 and 6.3-10 to illustrate the listed entry points. “Covering flap” 
means that the suit material covers the named metal, and there will be little or no plasma 
contact. Superscripts refer to the references presented after the table. 

The NESC team decided to use the neck ring as the plasma contact entry and the waist ring as 
the ISS conductive entry to provide a current path through the thorax of the astronaut for worst- 
case calculations. The NESC team considered that the International Space Station (ISS) 
Probabilistic Risk Assessment (PRA) EVA Shock Update and Summary has assumed contact with 
all possible external metal contact points [Duncan, 2013]. These have all been covered with 
flaps of material as can be seen in the various photos of the EMU. The contact point material 
(anodize or paint or stainless steel) does not matter. 

• Isolation of MM WS Components: 

o Implementation to reduce electrical current paths 

• Isolation of interface receptacles using non-conductive materials: 

o Kapton® film acts as a dielectric membrane between Al baseplate and stainless 
steel receptacles 

o Hard anodized washers are used to isolate conductive paths through fasteners 

• Testing and validation: 

o Isolation checks 
o Mechanical stress test 
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Table 7.9-1. EMU Metal Entry Points Summary 


# 

Name 

Material 
(Coating & 
Covering) 

ISS Contact? 
Per NESC team 
usage 

Pfair 
(Ranking 
for ISS 
contact) 

Plasma 

Contact? 

Comments, 
References 
and NESC 
team action 

1 

Scye Bearing 1 SB 2 

covering flap 

Less likely than 
waist bearing 

0.00000 
(8, 11) 



2 

Arm Bearing 1 AB 2 

covering flap 

Less likely than 
waist bearing 

0.00025 

(5) 



3 

Wrist Bearing 1 
(or Wrist Ring) 

covering flap 

Less likely than 
waist bearing 

0.006 

(D 



4 

Waist Bearing WB 2 / 
D-Rings 1 

covering flap 


0.003 

(4) 

Considered 
most likely as 
plasma 
contact 

(is sometimes 
“waist ring”, 
or WR) 

5 

Thigh 

Disconnec^TD 2 

covering flap 

Less likely than 
waist bearing 

0.005 
(2 & 3) 



6 

Ankle 

Disconnect 1 AD 2 

covering flap 

Less likely than 
waist bearing 

0.001 
(6 & 7) 



7 

Body Seal Closure- 

(BSC)/MMWS 

Connection 1 

covering flap 

BSC equally likely 
to waist bearing 

0.001 
(6 & 7) 

Considered 
most likely as 
plasma 
contact 

MMWS 

isolated 1 

8 

Neck Ring 'NR 2 


Less likely than 
waist bearing 

0.00000 
(8, 11) 


Reference 2 
states 

probability of 
ISS contact is 
0.00000; and 
plasma 
contact to NR 
lower than 
BSC orWR. 

9 

Helmet Purge 
Valve ^PV 2 

covered with 
white 


0.00000 
(8, 11) 


No outside 
exposure 

10 

CCA 3- 

no outside 
exposure 

N/A 

0.00000 
(8, 11) 


No outside 
exposure 

11 

*0BS/DCM 2 

insulated and 

electrically 

isolated 

N/A 

0.005 
(2 & 3) 


>50 

megohms per 
Ref 3 

12 

(not EMU) 

Any ISS damaged 
anodize 2 

Most of the 
ISS exterior 
metal has been 
anodized 

Consider only 
direct contact for 
EMC/ astronaut 
hazard 
assessment 

0.01 

(rank is high) 

N/A 

One part of 
EMU must 
touch this for 
Damage 
probability 
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# 

Name 

Material 
(Coating & 
Covering) 

ISS Contact? 
Per NESC team 
usage 

PfaiF 
(Ranking 
for ISS 
contact) 

Plasma 

Contact? 

Comments, 
References 
and NESC 
team action 

13 

(not EMU) 

Any ISS exposed 
stainless steel 

Lots of bits and 
pieces (nuts & 
bolts; solar 
array 

tensioners and 
other unlisted 
items. 

Consider only 
direct contact for 
EMC/ astronaut 
hazard 
assessment 

0.01 

(rank is high) 

N/A 

One part of 
EMU must 
touch this for 
damage 
probability 


1. ISS-NCR-232F (2012): Lack of Two-fault Tolerance to EVA Crew Shock in the Low Earth Orbit Plasma 
Environment, 1/31/2012, Boeing ISS System Safety, Joseph E. Thomas, originator. Pages have Tracking 
Number: (blank), “International Space Station Safety Noncompliance Report (NCR),” Date: 1/26/12. 

2. Duncan, G. (2013): Document DRD-MAPI-SA-06-ISSPRA-12-56, EVA Shock Update and Summary, 
International Space Station (ISS) Probabilistic Risk Assessment (PRA) Trade Study - Long Form, ISS-PRA- 
12-56 (Probability Risk Assessment Doc), Prepared by Gary Duncan, dated May 17, 2013. 

3. Castillo, M.; PPT “Modular Baseplate Assembly/Body Restraint Tether/Flandrail Electrical Continuity Test”, 
ONE EVA, 05/04/10. 

The Material column contents are only outlined as rough descriptions of the coating and covering. The probability 
of failure is shown in the Pfail column as contained in ISS-PRA-12-56. 

*OBS/DCM (Display and Control Module) is located above the BSC with the MMWS. 

Figure 7.9-1 shows the communications carrier assembly (CCA) [Duncan, page 7, Figure 2, 
2013]. The CCA is a fabric cap worn by the astronauts with microphones and speakers for use 
with the radio. It allows hands-free radio communications within the suit. It seems to have no 
external connections, but the ISS-PRA-12-56 implies that there is a connector that is exposed on 
the outside of the EMU. The CCA probability of contact with the ISS chassis is rated in the ISS- 
PRA-12-56 as 0.00000. Figure 7.9-1 also shows visible wrist rings before attaching gloves. 
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Photo Courtesy NASA 


Figure 7.9-1. EMU Photo. Note CCA -a cap with microphone and speakers. Note visible wrist 

rings before attaching gloves. 

Figure 7.9-2 is another EMU photo that also shows the exposed wrist ring before the covering 
flap is positioned over the ring. Note on the right that the covering flap leaves no exposed wrist 
ring for contact with space plasma; other details can also be seen. 

Figure 7.9-3 is a photo of a suited astronaut. Additional EMU pictures to support this section are 
included in Appendix E. 
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ISS008E22163 


Photo Courtesy NASA 


Figure 7.9-2. EMU Photo 
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Figure 7.9-3. Suited astronaut: EMU upper part (picture source unknown). Some details of wrist, 
EMU tether lower right and equipment/tool tether (right) shown. 


Reference: 

1. Duncan, G. (2013): Document DRD-MAPI-SA-06-ISSPRA-12-56, EVA Shock Update and 
Summary, International Space Station (ISS) Probabilistic Risk Assessment (PRA) Trade 
Study - Long Form, ISS-PRA- 12-56 (Probability Risk Assessment Doc), Prepared by Gary 
Duncan, dated May 17, 2013. 

7.10 Reassessment of the Positive Voltage EVA Hazard 

The upper bound electron collection currents that could flow through an astronaut as a result of 
low positive potentials are less than 1 mA. This is an order of magnitude lower than the lowest 
currents in ISS-NCR-232F [Kramer, et ah, 2010], and may not be hazardous. 

The changes to the EMU outlined in the “NESC ISS Shock EVA Actions.pptx” (provided in 
Appendix D) have eliminated almost all electrical current paths for electrons collected from the 
ionosphere to flow through the astronaut’s torso to the ISS structure ground [Roeschel, 2013]. 

A single, highly improbable electrical current path has been identified. Maximum currents 
through this path for both solar max and solar min are shown to be less than 1 mA. Based on 
these calculations, it is suggested revisiting the question of whether plasma currents from low 
positive voltages are an EVA hazard. The analysis does not consider whether a hazard exists 
when there are large negative potentials on the ISS and the plasma contactor is not operating and 
merely assumes these conditions for conservatism. 
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Analysis 

Under normal conditions, since the astronaut’s tether has an insulating segment, there is no 
electrical contact between the astronaut and potentials on the ISS [Roeschel, 2013]. However, in 
the unlikely case that the tether is in electrical contact with a ring on the EMU, then electrical 
current could flow through the astronaut to another anodized ring exposed to the plasma and 
back through the plasma, as shown in Figure 7.10-1. 



Figure 7.10-1. Circuit where the Astronaut is ~15V Positive with Respect to the Surrounding 

Plasma 


This requires physical contact of the bare metal tether with a suit ring whose fabric cover has 
been inadvertently displaced (see Figure 7.10-2) on the stainless steel bearing ring, not an 
anodized ring. Electron current can be collected when the potentials on the EMU are positive 
with respect to the ionosphere plasma, such as those possible due to the station’s motion across 
the Earth’s magnetic field when the plasma contactor is operational. Following Kramer, et ah, 
the extreme worst-case positive potentials possible in this scenario are the order of 
approximately +15V, and such potentials can only occur outboard of the SARJ [Kramer, et al., 
2010 ]. 
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Figure 7.10-2. Example of an exposed section of the stainless steel wrist bearing ring directly above 
the blue anodized ring [Roescbel, 2013 /. Normally both rings are covered by suit fabric. 

Electrically, the circuit is represented schematically in Figure 7.10-3. Positive potential 
generated at the end of the truss by the ISS’s orbital motion is carried to the suit by the tether 
contacting the waist ring. This positive potential goes through the astronaut’s torso and appears 
on the exposed, anodized neck ring. This scenario also assumes there are flaws in the 
anodization on the interior of the suit, and electrical current flows through sweat-soaked 
garments through the torso, not around it. Calculations below exclude electrical current 
collection by modular base plate because the data presented by Castillo (provided in 
Appendix D) showed it was electrically isolated from the rest of the EMU. 


NESC Request No.: TI-13-00869 


@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

13-00869 

Version: 

1.0 

Title: 

ISS PCU Utilization Plan Assessment Update 

Page #: 

75 of 225 



Figure 7.10-3. Electrical equivalent circuit. The only metal surface always exposed to the 
ionosphere is the neck ring, which has an insulating coating. (EMU figure from ISS-NCR-232F). 

The electron current that flows is limited by the electron current collected from the ionosphere 
by the exposed section of the EMU neck ring. To estimate the collection, approximate the 
exposed area of the ring as a strip 1-inch wide by 1-foot long. 

Aring : = = 0.008 Ml 2 

The simplest estimate of the current an object can collect from a plasma is to assume that every 
electron that conservation of angular momentum would not prevent from being collected is 
collected. This an upper bound, called “Orbit Limited Collection” to the actual currents 
collected by complex objects in a dense plasma where potentials on nearby dielectric materials, 
shadowing by other objects, and space charge effects can dramatically limit the current. For 
symmetrical conductors floating in space, three different expressions, shown in Figure 7.10-4, 
can be used to estimate the orbit limited upper bound current depending on the relative 
dimensions of the object. In the figure, the abscissa is the potential on the object divided by the 
electron temperature and ordinate in the plot labeled “Current” is the current density to the object 
divided by the electron thermal current density. For a long, thin object (e.g., the neck ring), the 
cylindrical probe approximation is appropriate. 
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Probe design for orbit-limited current collection 

J. O. Laframboise & L. W. Parker 

THE PHYSICS OF FLUIDS VOLUME 1 6 . NUMBER S 19 7 3 




Figure 7.10-4. Plasma Current Collection for Spherical (3-DIM), Cylindrical, and Planar Probes 

[Hamilton and Kramer, 2007] 


Following J.E. Allen, “Probe Theory - The Orbit Motion Approach,” Physical Scripta. Vol. 45, 
497-503, 1992, the collected current in terms of the one-sided electron thermal current density, 
the area of the collecting surface, and the applied dimensionless potential can be written [Allen, 
1992]. 


1 cylinder = nr p U 


kT 


\ 1/2 


v 2n m j 


f 


eV 

1 + — ^ 
kT 


= j th A 


cylinder 


(i +zf 


X 


eV 

_ p 

= kT 


where the one-sided electron thermal current is defined as 


3 th j T) e charge 

Fortunately, the ISS FPMU [Wright, et ah, 2008] has a cylindrical probe, narrow-sweep 
langmuir probe (NLP), with dimensions similar to that of an anodized ring. One way to test the 
cylindrical formula’s applicability is to compare the calculated current using it with the actual 
electron current measured by the NLP. 

The NLP, shown in Figure 7.10-5, is one of the instruments on the ISS FPMU. 


e charge * T 

2-7 r • 
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Electronics 
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Figure 7.10-5. Diagram of FPMU in its Deployed State with Indicated Dimensions 

[ Wright. , et al., 2008] 


The NLP is a gold-plated cylinder with a radius of 1.43 cm and length of 5.08 cm. Its area is 
0.005 m", a little over half the team’s estimate of the exposed anodized area of the neck ring. An 
electron current collection curve is shown in Figure 7.10-6. 


3 

2 

< 1 


1 



-3 
-4 
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Figure 7.10-6. An NLP Electron Current as a Function of Voltage 
[Wright, etal., 2008] 
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Using the parameters in the figure and the cylindrical orbit limited collection fonnula the 
electron collection at the highest potential is 3 1 (microampere) pA about 50 percent higher than 
the 20 pA measured current shown in Figure 7.10-6. 

»s=1.18*10 n m -3 T e .= 940 V 

11604 

ith(n,T e ) = (9.003- 10- 4 ) Ar 

m 

(j) := (l3 — 9.47) U=3.53 V 

Apro6(> : =2 7r* (l.43 cm) *5.08 cm = (4.564 -10" 3 ) m 2 


2 

I probe ~Aprobe'jth \ n > Tg) * ~ 


( 0 ) 
1 




As expected, the current to the probe, I pro be, calculated using orbit limited theory is larger than 
the measured probe current because orbit limited theory, as discussed above is an upper bound. 
More accurate formulations that take into account the effect space charge (finite Debye length) 
would reduce the calculated current. 


Using worst-case solar max plasma environment and worst-case v x B • L potential from in ISS- 
NCR-232F (Attachment 8), the upper bound, orbit-limited collection current is less than 1 mA. 

n:=10 12 m -3 T e := 0.1 V 


<t>:=15V A ring =— -j~ ft* =0.008 m 2 

1 

~2 

2 / ^ ' 

I ring := Aring' jth( n t^e) ' |l+'= — 

\Jn \ Je > 


= 0.91 mA 


The currents listed in ISS-NCR-232F/Attachment 8 for these conditions are as much as 50 times 
greater than this upper bound value (see Figure 7. 10-7). 


Modified-MMWS Maximum Currents 


V=15volts 

T P =0.1eV n P =1xio nTf* 
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Figure 7.10-7. EMU Currents Post MMWS Modification [ ISS-NCR-232F \ Attachments, 2012] 
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Discussion 

The calculation above gives very much lower electrical current values than used in ISS-NCR- 
232F for the particular case of the plasma contactor operating, the station experiencing a 
maximum v x B • L potential, and the astronaut at the extreme end of the truss. The calculated 
current, while significantly low, is probably an extreme overestimate because it is for a 
conducting cylinder sticking out in a plasma without any surrounding dielectrics to impede 
electron collection. 

As is pointed out by Kramer, et ah, 2008, because of surrounding dielectrics, the ISS solar array 
does not collect like the simple, orbit-limited theory. The ISS solar arrays collect much less 
electrical current than the model above would have predicted. For the solar array, the dielectrics 
reduced the electrical current by more than an order of magnitude. It can be expected dielectric 
on the suit as the same order of reduction in EMU currents compared with the upper bound 
calculated above. 

Another issue is the duration of the current. The value above is for the peak electrical current to 
the neck ring surface. Since the outer surface of the neck ring is insulating, it acts as a capacitor 
(Figure 7.10-3). In the calculation below, it can be assumed the coating is thin anodization. This 
is a worst-case for the charging time because it was assumed that a very thin coating and 
anodization has a very high dielectric constant. 

^anod ~ (l-27 • 10 ) m 
k = 6.7 


C. 




anod ‘ 


L anod 


-=(4.671.10 °) 


F 


2 

m 


The collected current reduces the voltage that is seen by the plasma. For the values above the 
timescale for the current to flow is less than one millisecond. Over that timescale, the average 
current is about half the calculated peak current. 


<t> 



K C anod * A-ring t 


= 0.9 


ms 


With respect to DC collection on the EMU, two factors combine that virtually eliminate any 
hazard from this type of collection. First, applying the appropriate plasma models (as discussed 
above) significantly reduces calculated current collection. Second, the electrical isolation of the 
MMWS (i.e., tool belt) radically reduces the area of exposed bare metal on the EMU. The 
reduction in collection areas is described in “NESC ISS Shock EVA Actions.pptx” (provided 
in Appendix D) [Roeschel, 2013]. Combining realistic current collection scenarios with a very 
small area of exposed bare metal on the EMU will result in an extremely small DC current 
collected by the EMU. 
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The accuracy of the analysis above includes many assumptions and approximations. It is beyond 
the scope of this task to perfonn a more accurate and detailed investigation. However, the above 
analysis shows that even a calculation that assumes that the neck ring collects like a cylinder 
floating in the ionosphere, rather than a sphere, marginalizes any astronaut hazard due to 
v x B • L-induced positive potentials when the PCU is operating. Accounting for the nearby 
dielectric suit surfaces and the actual EMU geometry will further reduce the currents collected. 

A more thorough investigation is warranted and will surely reduce the potential hazard from 
positive current collection. 
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Conference ‘Making Safety Matter, Huntsville, Alabama, USA, 19-21 May 2010 (ESA SP- 
680, September 2010). 

2. Roeschel, E. (2013): “NESC_ISS_Shock_EVA_Actions.pptx” 6-25-13. 
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5. Wright, et al. (2008): “Charging of the ISS as Observed by the FPMU: Initial Results,” IEEE 
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Orbit Plasma Environment, 1/31/2012, Boeing ISS System Safety, Joseph E. Thomas, 
originator. Pages have Tracking Number: (blank), “International Space Station Safety 
Noncompliance Report (NCR).” Date: 1/26/12. 

7.11 Features of the Current Path from the ISS-EMU-Plasma Circuit versus 
the Shock Hazard 

7.11.1 Electrical Current Path from the ISS through the Astronaut to the Plasma through 
Multiple Layers of Insulation 

The identified hazard is the possible flow of electrical current through an astronaut’s torso. The 
voltage that drives the electrical current is the difference between the ISS chassis at the location 
of the astronaut and the potential of the ambient ionosphere. If the PCU is not operating, this 
potential difference can be driven by a combination of the orbital motion of the station through 
the Earth’s magnetic field (v x B • L) and by the exposed electrical potentials on the ISS 160V 
solar arrays. The NESC team found that there are several specific features of the EVA suit - 
tether - tool system, each designed to interrupt the circuit. For electrical current to flow through 
an astronaut requires a simultaneous failure of several of these features. Below, the electrical 
circuit current path from the station is followed through the astronaut to the ambient ionosphere 
and identifies the four or five features in series that are designed to stop electrical current flow. 
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The astronaut is attached to the ISS by an 8 5 -foot safety tether. One end of this conducting 
tether is clipped to rings on the ISS. It is the NESC team’s understanding that the tether 
attachment point rings have an insulating anodized coating. This is the first break in the circuit. 

The end of the tether attached to the astronaut has several inches of non-conducting fabric 
specifically designed to insulate the astronaut from the ISS potential as shown in Figure 7. 1 1-1 
(all photos from Eduardo Roeschel, “NESC ISS Shock EVA Actions.pptx.”). See 
Appendix D [Roeschel, 2013]. 



Figure 7.11-1. Safety Tether showing the Insulating Fabric Section at the End 

The tether is attached to the waist ring on the EMU, as shown in Figure 7. 1 1-2. Notice the fabric 
end of the tether connecting to the EMU waist ring. 
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Figure 7.11-2. EMU showing the Fabric section of the Safety Tether and how all the Anodized 

Rings are Covered by the Suit Fabric 


The EMU suit has waist, elbow, and wrist rings made of anodized A1 and bearing rings of 
stainless steel. For the tether to transmit the station potential to the astronaut, the conducting 
tether would have to contact one of the stainless steel bearing rings where the covering fabric has 
been moved. The tether contacting the MMWS base plate is not a hazard, since the MMWS base 
plate is electrically isolated from the rest of the EMU. 

An alternative path is for an EMU ring to make direct electrical contact with the ISS. In order 
for this to occur, the fabric cover must be moved, the stainless steel bearing ring has to either 
contact the ISS at a location where the anodization has been removed, or there is an exposed 
stainless steel fastener. See Section 7.9. 

This still would not complete the circuit. If the sequence of events above were all to occur 
simultaneously, the ISS potential would be on a suit ring. There is a high probability that the 
astronaut’s perspiration would support a conducting path to the astronaut’s torso. Perspiration 
could then also make a conducting path to the neck ring. 

For negative ISS potentials, the circuit is then completed by ions from the ionosphere 
accumulating on the exterior insulating neck ring surface, charging it to the local ionosphere 
potential (see Figure 6.3-7d). The hazard comes from currents that would flow from a 
breakdown across that insulating surface (see Figure 6.3-7e). 
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For the positive potentials, the electrical current path is by electron collection on the insulating 
surface of the neck ring. As shown in Section 7. 10 of this report, the magnitude of this path is 
limited to less than 1 mA for 1 ms. 

In summary, to generate an arc that is hazardous to an astronaut, the station has to be at high 
negative potential and there must be a complete electrical circuit current path from the ISS 
chassis through the astronaut to the ionosphere to exist long enough for an arc to occur. To 
establish the electrical circuit associated with the negative charging hazard requires the following 
events to happen simultaneously during an EVA: 

1. at a location on the ISS where the anodized layer has worn through; 

2. the tether clip contacts the attachment ring; 

3. the conducting tether ahead of the insulating fabric section is in contact with a suit ring; 

4. where the fabric cover has pulled back; 

5. the ring is made of stainless steel, not anodized Al; 

6. there is enough perspiration for a low resistance path; 

7. the astronaut is in contact with the neck ring. 

The circuit parts (items 1 through 7) are shown schematically in Figure 7. 1 1-3. The probabilities 
are gross estimates. The “ISS Not Anodized” and “Contact Neck Ring” are based on the NESC 
team’s interpretation of DRD-MAPI-SA-06-ISSPRA- 12-56 [ISS-PRA- 12-56, 2013]. The 
purpose of Figure 7.1 1-3 is to show how many insulation failures must occur simultaneously in- 
series to establish the negative charging hazard circuit. 



0.01 1.0 0.01 0.1 0.5 



0.01 0.01 0.1 0.5 

Figure 7.11-3. Circuit Paths from ISS Chassis Ground to the Astronaut Inside the EMU 
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7.11.2 Effects of Coincidental EMU Insulation Failures 

The NESC team reviewed the “Shock to EVA Crewman due to Negative ISS Potential” in DRD- 
MAPI-SA-06-ISSPRA- 12-56. The hazard consist of the joint probability that the ISS chassis 
ground is at a potential more negative than -45V with respect to the local ionosphere and that 
there is a circuit path that connects the astronaut to the ISS chassis ground. 

Potentials more negative than -45V can only occur when no PCU is operating. In ISS-PRA-12- 
56, it is estimated that with the PCU off, the probability of a “negative potential situational 
condition factor” occurring during an EVA is 0.0137. In Figure 7. 1 1-3, the NESC team 
estimated the probability of a complete circuit from ISS ground to the astronaut within the EMU 
as 10’ 6 . This low value comes from the EMU modifications designed to prevent the shock 
hazard as described in Eduardo Roeschel, “NESC ISS Shock EVA Actions.pptx.” 

As discussed in Section 7.13.1, the probabilities in Figure 7.1 1-3 are crude estimates for 
illustrating the point that many insulation failures must occur simultaneously. The combined 
probability of the negative charging (0.0137) environment occurring and the circuit closure (10‘ 6 ) 
is about 1 in 10 million, a much lower probability reported in ISS-PRA-12-56: 

“The probability of the negative shock hazard is about 1 in 250,000.” 

7.12 Shunt Array FDIR 

7.12.1 FDIR Operation 

FDIR algorithms are used in the ISS system to detect that a fault condition has occurred, confine 
the fault, and execute a recovery process (ISS EPS TM 21 109) [Anon., 2004]. The array shunt 
FDIR is enabled, as a third shock hazard control, after the two PCUs are verified to be in 
discharge mode prior to the start of an EVA. The PCU will remain in this mode as long as the 
anode current is greater than 0.5A. Below 0.5A, the PCU returns to its startup routine. Five 
parameters are monitored for the PCUs: (1) plasma current, (2) anode voltage, (3) cathode 
heater voltage, (4) tank and tube temperature, and (5) tank and tube pressure. The PCU has its 
own FDIR, which reacts to the loss of or low discharge consequently setting the corresponding 
fault indicators. 

When enabled, the array shunt FDIR will monitor the PCU fault indicators. In the event of one 
PCU failure during or prior to an EVA (Plasma Hazard Mitigation during EVA, B9-908), the 
FDIR will shunt all active solar arrays. The EVA might continue with no more than two arrays 
unshunted while oriented less than 105 degrees from the velocity vector. These allowed arrays 
are determined as part of the pre-planning FP analysis. Subsequently, in order to maintain ISS 
power balance, arrays will be unshunted when needed, but after the panel is oriented more than 
105 degrees from the velocity vector. To remain power positive, the unshunting must occur on 
the order of 10s of minutes after the FDIR response. 

It is undesirable to keep the arrays shunted because extended battery discharge will occur on the 
order of 1 hour, which shortens the cell life. As of 2004, it takes an average of 5 1 minutes of 
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battery discharge (all arrays shunted) to deplete down to the maximum design depth-of-discharge 
of 35 percent [Dong, 2004; Dalton, 2004] (calculated from information in these references). 

The ISS battery capacity total is 192 kilowatt hours (kWh), with 24 batteries at 8 kWh each 3,4 
[Boeing, 2009; Space Systems/Loral, 1998]. One battery consists of two orbital replacement 
units (ORU) electrically in series. See Figure 7.12-1. 



NiH 2 Battery ORU 
©2007 Space Systems Loral 

Figure 7.12-1. ISS NiH 2 Battery ORU 

The FDIR was activated 3 times since it has been in use. The validation of the array shunting 
FDIR seems to have been limited. Below is a summary of the three on-orbit events: 

(1) 2006/348: 19:50 - In preparation for 12A.1 EVA 2 the FDIR was inadvertently actuated 
during a Nodel multiplexer/demultiplexer (MDM) transition. 2 of 3 deployed arrays 
shunted, 1 did not; root cause of arrays not shunting isolated to a timing issue between 
MDMs. (The software timing error was analyzed and fixed under SCR 35596.) 

(2) 2006/348:22:56 - During 12A.1 EVA 2, PCU1 was intentionally commanded to 
“standby” for assembly operations. PCU not in “discharge ” mode is one of the triggers 
to shunt the solar arrays. All arrays were shunted by the FDIR. 

(3) 2006/350:22:38 - During 12A.1 EVA 3, PCU2 was intentionally commanded to 
“standby ’’for assembly operations. All arrays were shunted by the FDIR. 


3 http://www.boeing.com/assets/pdf/defense-space/space/sDacestation/components/docs/S6.pdf 

4 http://sslmda.com/downloads/products/ispacest.pdf 
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7.12.2 Risks for High Negative Potential Peaks 

The array off pointing prior to unshunting is performed to reduce the RAM electrical current 
collection. However, the magnitude of the rapid charging event created during the unshunting 
(even in wake) has not been characterized. 

The use of the FDIR presents risks for high negative potential peaks of short duration if, during 
required power restoration following the FDIR, any array is unshunted in sunlight. The results 
of on-orbit experiments conducted in 2010 on days 155 and 205 through 212 revealed large 
negative potentials, up to -95V, when an array was unshunted in daylight while facing in the 
RAM direction with PCUs off. The duration of the peaks observed was approximately 10 ms. 
During the experiments, ah eight arrays were forced to remain shunted via ground commanding 
as the station entered insolation. Approximately 3 minutes into insolation, the arrays were 
commanded to unshunt one at a time. FP data from the FPMU was recorded, as shown in Figure 
7. 12-2. These potential peaks were present each time the commanded unshunt was performed, 
with minor variations in peak potential and peak duration. The experiments were limited to 
unshunting arrays in daylight at the beginning of the orbital day with the arrays facing in the 
RAM direction and PCUs off. More experimentation should be done to determine the nature of 
potential peaks at other times during the daylight portion of the orbit, at various array angles, and 
with PCUs on and off. Characterization of potential peaks with arrays pointing at >105 degrees 
from RAM is particularly important because it is the minimum pointing angle required during 
post-FDIR power recovery. Currently, there is no other data to support potential peaks when 
unshunting at >105 degrees. The FDIR is not a good hazard control strategy considering it could 
cause charging in excess of the defined hazard limit. It is unknown if these potential peaks are a 
hazard considering their short duration (-10 ms) because the defined hazard limit does not 
specify a time duration. 
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Figure 7.12-2. FP Data from the FPMU 

7.13 The Negative FP Limit 
EMU Limit 

The latest version of the Hazard Report (ISS-EVA-3 12-AC) and the NCR (ISS-NCR-232G) do 
not explicitly state a requirement for the FP limit of the EMU. A review of past NCRs and EMU 
documentation by the NESC team indicates that the EVA Office adopted -40V as the FP limit 
for the EMU in 2002. The adoption of the -40V level for the EMU appears to have occurred as 
a result of testing in 2001 at MSFC. Specifically, in 2001, a set of arc tests on EMU samples 
was performed. A statistical analysis of 10 samples was performed. These data were presented 
in an American Institute of Aeronautics and Astronautics (AIAA) conference paper in January 
2002 [Schneider, 2002]. The statistical analysis indicated a median arc voltage value of -74V 
with a standard deviation (a) of 8. IV. In April 2002, the statistical summary was presented by 
Hamilton Sundstrand (the EMU manufacturer) to an ISS/EVA panel [Gworek, 2002]. In that 
presentation, it was noted that -40V represented 4.2 standard deviations (4.2a) from the median 
arc voltage. According to the presentation, the 4.2a value represented a 0.01 -percent chance of 
arcing at -40V. 

ISS Vehicle Limit 

The negative FP limit associated with the ISS vehicle was established to be -40V after a limited 
number of arcing tests in 1991 described in Section 7.13.1. However, per the ISS-NCR-232G, 
Block 13: “The largest accepted charging violation is -45.5 V. ” This safety margin reduction is 
justified, in the same NCR: “At the 1/14/09 SRP, a risk acceptance point of -45.5V was agreed 
upon by the Panel as a final non-negotiable limit for the negative potential. It was believed that 
the risk of increase in voltage was within the realm of engineering judgment acceptance. ” 
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The ISS-NCR-232F/G document accepts an increased risk associated with an EMU possibly 
encountering a section of ISS charged to -45.5V for scenarios involving a PCU failure as 
described by the following statement: 

“In order to stay within previously accepted charging exceedances, OCAD #1 00006 
specifies that only pairs of arrays which result in charging levels lower in magnitude 
than -45.5V, per attachment 1, may be excluded from shunting and allowed to 
autotrack following a PCU failure. ” 

References: 

1. Schneider, T.A.; Carruth, M.R., Jr.; and Hansen, H.J. (2012): “Minimum Arc Threshold 
Voltage Experiments on Extravehicular Mobility Unit Samples,” AIAA Paper 2002-1040, 
40 lh AIAA Aerospace Sciences Meeting and Exhibit, Reno, NV, January 14-17, 2002. 

2. Gworek, P.; and Hansen, H. (2002): “EMU - Plasma Arc Update”, Presentation to CCB, 
Hamilton Sundstrand Space Systems International, Inc., April 3, 2002. 

7.13.1 Origin of the -40V ISS Charging Limit 

The ISS, like many spacecraft, uses A1 metal in the construction of most of its structural 
components - due to the lightweight nature of Al. To avoid corrosion issues, A1 is anodized. 

The anodizing process creates an oxide layer on the Al surface, which protects it from corrosion. 
The oxide layer is a dielectric layer (i.e., electrically insulating). In the case of ISS, the MMOD 
shields form the outer shell of the spacecraft and are in contact with the ionosphere plasma 
environment. The MMOD shields are made of Al metal and are anodized. In fact, a special 
anodization process was used to protect the MMOD shields on the ISS, which represent a large 
fraction of the vehicle’s surface area. The special anodized coating was needed to obtain 
thermo-optical characteristics, which would keep the MMOD shields relatively cool compared to 
standard anodized Al components. The special anodizing process used on the ISS MMOD 
shields resulted in an extremely thin anodization (oxide) layer, with thickness on the order of 
1.3 microns. 

Early in the design process for the ISS, a solar array power system was adopted which operates 
at 160V. The power system also employs the standard negative ground scheme, whereby the 
negative terminal of the power system is attached to spacecraft chassis (i.e., the Al metal hull), 
which includes the MMOD shields. Recognizing that the 160V solar arrays would interact with 
the ionosphere plasma, NASA personnel in the field of spacecraft charging predicted that the ISS 
vehicle would experience negative charging on the Al metal hull, followed by positive ion 
collection on the RAM facing anodization layers. The result would be a large electric field 
developing across a very thin dielectric layer. In the event the electric field exceeded the 
dielectric strength of the anodization (oxide) layer, an electrical discharge (arc) would form and 
damage the anodization layer. In a related scenario, if a micrometeoroid particle were to impact 
a charged anodization layer, it could precipitate an arc. 

Therefore, in the 1990 to 1991 time period, M. Ralph Carruth Jr., and Mr. Jason Vaughn, from 
MSFC, conducted a test campaign to determine if an arc would be generated on a negatively- 
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charged anodized A1 plate immersed in a plasma environment in the event that the anodized 
layer was struck by a micrometeoroid particle. The tests sought to determine if there was a lower 
charging limit such that an arc would not be generated in the event of a particle strike. 

All of the tests were conducted at Auburn University using a “hypervelocity gun” as a source of 
fast micrometeoroid particles. The tests were very time consuming to set up and execute. A 
plasma comparable to the ionosphere plasma had to be created and maintained at high vacuum, 
an anodized sample had to be charged to a specific voltage, and the high energy hypervelocity 
gun had to be successfully fired during the time window when the plasma and charging 
conditions were as desired. 

The complexity and long set up times associated with the Carruth and Vaughn test led to only a 
limited number of successful shots. Details about this test campaign appear to be captured in the 
following reference: “Minutes from the Joint Meeting of the Electrical Grounding Tiger Team 
and the Electrical Power System Working Group for Development of the Decision Package 
for SSF Electrical Grounding,” Fairview Park, OH, August 5-7, 1991, (Carruth and Vaughn), 
pp. 172-181. Unfortunately, this reference appears to have had only a limited distribution and, 
unfortunately, the NESC team has not found a copy of this report. 

Fortunately, both Carruth and Vaughn still work at MSFC and can be consulted about their 
recollection of the test campaign. According to Mr. Vaughn in a December 3, 2013, e-mail to 
Todd Schneider: 

What I remember was we ran several tests with single MMOD shots at each level. We 
started at -150V and went down in steps of -25V. We definitely saw an arc at -75V, but 
it did not appear to be a full discharge of the cap [capacitor] . With one shot at -50V, we 
did not produce an arc. Because we did not see an arc at -50V, we asked for more 
resources to generate more data and better statistics at -50V. However, at that time in 
the investigation and all the data pointing to needing a PC [plasma contactor] , the 
program managemen t decided to solve the problem with the addition of the PC [plasma 
contactor] . 

From past discussions between Carruth and Schneider during ISS Plasma Charging Tiger Team 
activities in 2000, the ISSP (in 1991) asked Carruth to recommend a safe charging level for 
anodized ISS structural elements. Based on the limited data at -50V, Carruth recommended 
adopting a 10V margin and suggested -40V. 

The origin of the ISS -40V limit, therefore, is based on the work of Carruth and Vaughn in the 
early 1990s to determine a voltage whereby a charged section of the ISS MMOD shield would 
not arc in the event that section was struck by a micrometeoroid particle. 

In parallel with the work at MSFC to investigate arc initiation was an effort to determine the 
expected vehicle charging levels due to the interaction between the high voltage solar arrays and 
the ionosphere plasma environment. In 1991, at the Lewis Research Center (LeRC) - later 
renamed Glenn Research Center - Carolyn Purvis, Dale Ferguson, and David Snyder made 
measurements of the current collection of ISS solar array (or photo-voltaic array) panels in a 
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representative ionosphere plasma. Their measurements showed that the ISS solar arrays were 
capable of collecting large electron currents from the ionosphere plasma, which pointed toward 
ISS vehicle charging levels that could reach -140V. 

Recognizing the need to limit ISS vehicle charging in order to minimize arcing on anodized 
surfaces, the LeRC team developed an active charge control system. Michael Patterson (LeRC) 
used the setup built by Purvis, Ferguson, and Snyder to demonstrate that a hollow cathode device 
could be deployed on ISS, which would actively control/limit the charging on the ISS chassis to 
-40V. The hollow cathode system demonstrated by Patterson became known as the PCU and 
formal implementation of the PCU was approved in April 1992 [Moorehead, 1992]. 

At the time the -40V limit was established, the primary concern about the ISS spacecraft 
charging was related to the potential damage that an arc could do to the anodization layer on a 
MMOD shield. If enough arcs occurred on the MMOD shields, the thermo-optical properties of 
the anodization layer on the MMOD shield could be significantly altered, which would result in 
taxing the ISS cooling systems. In other words, in the 1990s the problem associated with arcing 
on ISS was a vehicle-level problem, and not a personnel safety problem. 

Reference: 

1. Moorehead, R.W., Deputy Director (1992): Space Station Freedom Program and 
Operations, communication to Work Packages 1-4 Directors, dated April 3, 1992. 

7.13.2 Plasma Safety Hazard Identification and Risk Acceptance at -45.5V Charging 
Levels 

In September of 2000, Schneider and Carruth, conducted a test (at MSFC) to determine if 
components of the EMU would arc if they were charged in the presence of a plasma 
environment. This test was triggered by the work of members in the ISS PCU Tiger Team, who 
recognized that it might be possible for the EMU to become charged to the same potential as the 
ISS vehicle metal chassis. The results of the test by Schneider and Carruth showed that EMU 
components (e.g., the display and control module) could indeed arc. In fact, an arc at -68V was 
recorded for an anodized component of the display and control module in the MSFC plasma test 
chamber. 

Thus, a shift occurred in the ISS spacecraft charging community from concern about arc damage 
on the ISS vehicle to a possible electrical safety hazard for an astronaut conducting a spacewalk 
wearing an EMU. 

In the 2000 to 2001 time period, studies by the EMU suit manufacturer Hamilton Sundstrand and 
NASA’s EVA teams confirmed that electrical pathways did exist which would allow for the 
EMU suit to reach the same charging level as the ISS vehicle. So, if the ISS vehicle was 
experiencing charge levels of -80V, then it would be possible for the EMU to also charge to 
-80V. Since the EMU did contain anodized components exposed to the ionosphere plasma, the 
possibility existed that electrical discharges (arcs) could develop on those EMU components via 
dielectric breakdown. Unfortunately, since the astronaut is in contact with metal components 
inside the EMU, due to conduction via the perspiration-soaked cooling garment covering their 
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bodies, there is a possible safety concern that emerges since the astronaut’s body is part of an 
electrical circuit in which an arc is occurring. That is, an electrical shock hazard could becreated 
for an astronaut inside an electrically charged EMU suit. 

To help in determining the safe operating limits for EMU charging, Harold Hansen (Hamilton 
Sundstrand) and Todd Schneider (NASA/MSFC) conducted an arcing test in 2001 using 
anodized A1 samples prepared using the same processes as EMU components. The full test 
description and results can be found in Schneider, et ah, 2002. 

The 2001 test by Hansen and Schneider showed that within the limitation of a dataset that 
included only 10 samples, a statistical fit to the data indicated that -40V represented a 
0.01 -percent probability of generating an arc on an anodized EMU component. Using the test 
results, combined with the previously defined vehicle limit, it appears that in 2002 the EVA 
Safety teams adopted -40V as the safe limit for EMU charging. This limit was then applied to 
the creation of EVA reports and hazard documents. 

As the EMU plasma shock hazard represented a possibly catastrophic hazard for the astronaut, it 
was mandated that a two-fault tolerant safety system be used to protect the astronaut on EVA 
from the plasma charging hazard. To meet this two-fault tolerant requirement, two PCUs were 
operated during an EVA and solar arrays were shunted (i.e., power production from the array 
was stopped by shorting the output of the array). This ensured that the ISS charging would be 
more positive than -40V. 

By 2007, a better understanding of the ISS spacecraft charging had emerged with the availability 
of measured vehicle charging data from the FPMU, which was deployed on the ISS in 2006. 
Using a modeling capability based on empirical data, the Boeing Company projected a scenario 
in which a -45.5V charging level could be reached on the ISS in the event that no active charge 
control device (e.g., PCU) was operating, but the solar arrays were producing power (i.e., not 
shunted). This marks the first time an exception was made to allow for a scenario in which an 
EVA astronaut might be exposed to charging levels exceeding the -40V charging limit. The 
exception is documented in the “ISS Safety Noncompliance Report,” ISS-NCR-203 Rev. B, The 
Boeing Company/Space Exploration/International Space Station, September 19, 2007 [Boeing, 
2007]. It should be noted that this NCR was intended only to cover the ISS build stage 10A 
(October 2007 to February 2008). 

The exception documented in the ISS-NCR-203 Rev. B is actually a worst-case scenario in 
which two PCUs fail and solar array shunting is not allowed due to the need to maintain a 
minimum safe power level onboard the ISS. The -45.5V level is actually a model prediction 
using the Boeing Company’s ISS charging model. 

In 2009, using the ISS-NCR-203 Rev. B as a precedent, a SRP apparently agreed to once again 
accept the risk associated with an EVA continuing after predicted potentials could reach -45.5V. 
Recall that the following statement documents that decision: 
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“At the 1/14/09 SRP, a risk acceptance point of -45.5V was agreed upon by the Panel as 
a final non-negotiable limit for the negative potential. It was believed that the risk of 
increase in voltage was within the realm of engineering judgment acceptance. ” 

This statement appeared in ISS-NCR-232F, “Lack of Two-fault Tolerance to EVA Crew Shock in 
the Low Earth Orbit Plasma Environment, ” The Boeing Company/Space Exploration/ 
International Space Station, Joseph E. Thomas (Document Originator), 1/26/2012, page 6 
[Thomas, 2012]. 

It is important to distinguish between a risk acceptance of -45.5V and a safety limit of -40V. 

The risk acceptance does not change the established safety limit, rather it allows for an EVA to 
continue with only single-fault or zero-fault tolerant hazard controls and increased safety risks. 

The -40V charging limit for both the vehicle and the EMU was based on test data. In the case of 
the vehicle, the test data focused on micrometeoroid impact induced arcing. In the case of the 
EMU, the testing was on dielectric breakdown of samples produced by Hamilton-Sundstrand, the 
vendor who constructed the EMU. Thus, it seems prudent that changes to the established 
charging limits, for either the vehicle or the EMU, would be accompanied by new test data that 
makes a compelling case. 

Reference: 

1. Boeing (2007): “ISS Safety Noncompliance Report,” The Boeing Company/Space 
Exploration/International Space Station, ISS-NCR-203 Rev. B, September 19, 2007. 

2. Thomas, J.E. (2012): Lack of Two-fault Tolerance to EVA Crew Shock in the Low Earth 
Orbit Plasma Environment, The Boeing Company/Space Exploration/ International Space 
Station, Joseph E. Thomas (Document Originator), ISS-NCR-232F, 1/26/2012. 

7.14 Review of the ISS-NCR-232G: Lack of Two-fault Tolerance to EVA 
Crew Shock in the Low Earth Orbit Plasma Environment 

The ISS-NCR-232G is the governing document to define the use of controls during EVAs, lack 
of three controls (two-fault tolerance), or failures of controls. In addition to the discrepancies in 
the control approach, as defined in Section 6 of this document, the NESC team agreed there are 
inconsistencies and other general statements to address in the reviewed documentation. For 
example: 

o The document implies that independent Space Environment Scientists are in agreement 
with “the environment will remain benign at least through Solar Cycle 25 which extends 
through -2030. ” The NESC team does not agree this is widely accepted, 
o There are obvious inconsistencies, relating to the ISS safe FP limits. Currently, both 
-40V and -45.5V are referenced. If -40V is the limit and the -45.5V includes the 
accepted risk, it needs to be explicitly stated. The tolerance of the calculations also needs 
to be taken into consideration. 

o There is no safety limit specified for the positive potential (if considered a hazard) and 
electrical current collection. 
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o The use of the “short-term” expressions is misleading when referring to a 14-day forecast 
since a 1-day prior to forecast might be in order. 

o There is no coherent list of all possible electrical current entry points into the astronaut 
via the EMU’s external metal contact points, especially when also looking at the PRA- 
12-56. 

Refer to Appendix C for the complete review of the ISS-NCR-232G. 

7.15 Examination of ISS-PRA-12-56: PRA for Shock Hazard 

At the request of the NESC team, a Jet Propulsion Laboratory (JPL) PRA expert briefly reviewed 
the information provided by the NESC team, the ISS-PRA-12-56 document. He recommended 
that the PRA material, as it exists, needs an in-depth review. This conclusion is based on the 
following observations: 

• The event sequence diagrams, event trees, and fault trees (a) lack direct provenance to the 
experiential evidence used to derive and quantify them, and (b) need to be reviewed for 
completeness (i.e., determine whether any potentially risk significant events/phenomena 
are omitted). 

• As much of the probabilistic data originally resulted from expert opinion, the data need to 
be either verified by comparison with physical data or physics-based models, or have the 
uncertainty assigned to the probabilities expanded to include variations among cognizant 
experts. 

• The ISS PRA report describes a model and data, which were quantified using the 
Systems Analysis Programs for Hands-on Integrated Reliability Evaluations (SAPHIRE) 
software tool. The fidelity of the model and data to the physics of EVA shock need to be 
reviewed — the intent should be to perfonn a broad, “horizontal” review followed by 
selected “vertical” slices. 

• It is not clear if the negative case considers the PCU “on” (study categorizes the PCU as a 
positive hazard contributor) or if the analysis takes into consideration the suit changes or 
if the changes reduced the hazard posed by the PCU. 

7.15.1 Additional PRA Review 

A review of the PRA documentation package provided [1,2] revealed lapses in clarity and detail. 
The methodology and underlying assumptions provided are insufficient to enable duplication of 
the stated findings. In general, the document would benefit from an editorial review of its 
detailed content. However, several areas could potentially benefit from additional detail. In its 
present form, the PRA does not meet commonly held standards for technical rigor [3]. Selected 
examples follow in the interest of increasing the level of clarity and potential value of the 
presentation: 

• Terminology and labeling between documents greatly reduces clarity of presentation ([1], 
page 8): “+Transient Capacitive Discharge Hazard” is referred to as “AC Shock” in PRA 
[1, page 14]. Similarly “+DC Hazard” is labeled “DC Shock” [1, page 13], etc. To find 
these details one would need to be quite familiar with the contents of the PRA. Use of a 
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summary with common nomenclature between documents [1,2] could greatly help the 
clarity of presentation. A variation on Table 1 of PRA [1] would be preferable to relying 
on text to convey findings. This would allow the reader to more readily inter-compare 
relevant magnitudes. Why are probabilities for a “single crew member” provided in [1, 
page 8, see “PRA Updates and Results”]? In other sections, mean probability for “two 
crew members” are stated. If there is a compelling reason why this is done it should be 
clearly stated, if not, if one should consider simplifying to a common case and language. 
This would improve readability of the text for decision makers. At best, the current 
narrative formats used in [1,2] are challenging to decipher and time consuming if one 
wished to compare in detail. 

• Clarity ([1], page 8): The term “baseline” needs to be clearly defined. See comment 
below regarding “baseline” definition used in PRA. 

• Documentation of methodology ([2], page 1 1-12): Contact probabilities (Table 3-4) 

justification largely unstated - some appear larger than one might expect given present of 
insulating material. Have these tables been updated to reflect suit modification? Text 
presently states: . .reliability data used to populate the events in model originally 

generated in 2008 using expert judgment. . . .” Table 2 provides point estimate for 
“negative potential situational condition factor = 0.0137” - what is the uncertainty in this 
value? Stated uncertainties in contact probabilities all have “uncertainty 7 log normal” — 
unclear what this means here - is this the standard deviation, error factors [7, pages 78- 
79], or other? Unclear why all uncertainties have the same magnitude. 

Comment: At a minimum, it would appear to be of value to reveal these inputs, document 
rationale, and where the possible link to physical measurement is (e.g., contact 
probability of anodized-anodized A1 surface ~ 0.01, etc.). Unclear from documentation 
provided and hard to tell if values represent “opinion” or physical observation. Similar 
comments hold for the uncertainties used in simulations. 

• A contact probability of zero is equivalent to “not credible” [2], Inclusion in this fonn 
merely tends to complicate model topology and distract from clarity of presentation. 
Reader is left pondering why such events are present beyond indicating that they have 
been considered. 

Comment: The results presented in the document cannot be uniquely reproduced from the 
explanation provided. Would be of value to compute and explicitly document product of 
values leading to max-min probabilities. Such a crosscheck would bound the expected 
order of magnitude and validate of the detailed simulation described [2, pages 16-62]. 
Such an exercise could potentially lend physical insight and credibility to the modeled 
results. 

• Unclear [2, Figures 6-8]: 2- versus 1-Crew probabilities appear to scale with exposure 
time. This makes physical sense, however, inclusion merely graphically confuse data 
presentation. Why is this information detail desirable to present? If it is - maybe of 
value clearly state desired conclusion. 
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• Unclear [2]: . .for a shock hazard, several events must occur simultaneously. . .” latter 

stated “. . .model does not depend on chronological sequence of events. . . .” Observation 
if “simultaneous” - how could sequence matter within such a logical framework? Given 
the underlying circuit topology assumed, the threat must occur at the same time a path is 
present. 

• Acronym “OBS” does not appear to be defined - from context reader might assume 
“Operational Bioinstrumentation System.” Similarly, acronym “CCA” does not appear to 
be defined - from context - appears to be an electrical connector interface or similar. 
Recommend checking documents [1,2] for definition of all acronyms. 

• Unclear [2]: “The risk of loss of crew (LOC) for a single EVA, but the baseline ISS PRA 
EVA model is presented for comparison only; it should be noted that the EVA shock 
hazard is the probability an EVA crew would experience a shock and imply LOC. . . .” 
Unclear why stated “baseline” is relevant if suit modification has occurred and in use? 
Why would one not treat the modified suit as the baseline and merely state improvement 
over prior art in passing? Alternatively, need to provide context and logic for stated 
baseline. 

• Executive Summary [2]: The potential is one parameter of interest here - the magnitude 
of the electrical current that can be sourced by the threat is the other - would be of value 
to briefly discuss both aspects. 

• Typesetting ([1], page 6-7): “. . .These five events are discussed individually below.” Six 
items are enumerated. Document could benefit from careful editorial review. 

References: 

1. ISS-NCR-232G (2013): Lack of Two-fault Tolerance to EVA Crew Shock in the Low Earth 
Orbit Plasma Environment, NCR-20264-R7, 18 September 2013. 

2. Schmidl, D. (2013a): EVA Shock Update and Summary PRA Report ISSPRA-1 2-56, NASA 
JSC, May 7, 2013, DRD-MAPI-SA-06-ISSPRA- 12-56. 

3. Stamatelatos, M. and Dezfuli, H. (2011) Probabilistic Risk Assessment Procedures Guide for 
NASA Managers and Practitioners, Second Edition, 2011, NASA/SP-201 1-3421. 

4. Smith, C.L. and Wood S.T. (2011a): “Systems Analysis Program for Hands-on Integrated 
Reliability Evaluations (SAPHIRE) Version 8, Volume 1 : Overview and Summary,” 2011, 
United States Nuclear Regulatory Commission, NUREG/CR-7039, Vol. 1. 

5. Smith, C.L. and Wood S.T. (2011b): “Systems Analysis Program for Hands-on Integrated 
Reliability Evaluations (SAPHIRE) Version 8, Volume 1 : Technical Reference,” 2011, 
United States Nuclear Regulatory Commission, NUREG/CR-7039, Vol. 2. 
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8.0 Findings, Observations, and NESC Recommendations 

8.1 Findings 

The following findings were identified: 

F-l. There are numerous shortcomings in the space weather forecast planning used on the ISS 
that limits its use for 14-day (or any) forecasting: 

— Ne and Te “forecast” is a simple persistence of condition methods based on the 
assumption that conditions in 14 days will be same as on day the FPMU 
measurements are obtained. 

— Validation of Ne and Te environment forecast is based on data from two limited time 
periods. 

— IRI model used to project measured data into future is a monthly average climatology 
model incapable of predicting the full range of environments responsible for ISS 
charging. 

- No complete verification of ability to predict ISS potentials 14 days in advance has 
been demonstrated. 

— Plasma hazard assessment report does not include information on current state of 
geomagnetic activity — no documented plans to deal with FPMU data obtained during 
disturbed periods when reference data may under represent the charging environment 
present in 14 days at the time of EVA. 

- Assumption that solar activity will remain benign through next solar cycle into -2030 
has no basis in current ability of solar physics community to predict future solar 
activity. 

F-2. The FPMU is an integral part of the proposed forecast process; however, there is no 
explicit contingency procedure when FPMU data is not available. 

— FPMU data are critical since Ne and Te values from the IRI statistical model are 
constrained by FPMU measurements in determining which set of IRI values are used 
as inputs to the PIM3.0 charging model calculations for the plasma hazard forecast 
approach. 

- A spare FPMU unit is available on board the ISS, but will require an EVA to replace 
a failed unit. 

F-3. Comparisons between calculations of the ISS potentials by PIM3.0 using the actual 
ionospheric environment with the real-time FPMU measurements has identified 
deficiencies. Potentials more negative than -45V have been measured on the ISS. The 
ionosphere forecast and PIM3.0 models are not capable of predicting these large 
potentials (see Figure 7.6-3). 

Limitations and sources of error in the PIM: 

- Analytical approximations used in the numerical solutions for the potential barriers in 
the gaps between solar cells (solar array electrical current collection model). 
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— Assumption that every solar cell collects the same electrical current. 

— Uncertainties in FPMU Ne and Te input data (due to FPMU data reduction errors). 

— Timing of FPMU data chosen for PIM3.0 input relative to charging peak. 

— Errors in knowledge of solar array angles, ISS flight attitude, and ISS velocity. 

— Variations in ion collection area (free parameter adjusted to obtain best results). 

— Use of static (equilibrium) charging algorithm cannot predict rapid charging events. 

— Use of single capacitance in time-dependent charging algorithms oversimplifies the 
physics of the ISS charging and fails to model fast transient charging. 

- The IRI and PIM3.0 models do not contain the appropriate physics to predict auroral 
charging. 

F-4. The proposed usage of PIM3.0 puts this model in the critical path to EVA, yet fails to 
meet the NASA modeling standards imposed after the Columbia tragedy. 

— The CAIB report and NASA’s response to it emphasizes that various aspects of 
ensuring credibility of modeling results gets conveyed to critical decision makers 
relying on those results. 

- PIM3.0 fails to meet the minimum requirements: 

• The limitations of the PIM3.0 are not explicitly kn own by the decision 
makers. 

• User’s manual and parameter definitions for the PIM3.0 code are not 
available. 

• The configuration files for the use of PIM3.0 are not documented in the pre- 
planning proposed procedure. These will constrain how the model is used 
every time. 

• The model has not been independently peer reviewed. 

• There is no process identified to update PIM3.0 to include physical changes to 
the station configuration. 

• There is no clearly documented validation, verification, or certification 
process. 

- This model should not be in the critical path if it lacks the pedigree associated with 
above mentioned standards. 

F-5. The PCU maintains the ISS near to space plasma potential, even under poorly 
characterized charging events like rapid charging events. 
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- Under the worst-case conditions, the PCU has the capability of sourcing enough 
electrical current to keep the ISS close to the plasma potential. 

- The PCU has demonstrated emission to 10 A in ground testing. (See Figure 7.8-1.) 

— The largest PCUs electrical current measured on orbit is 0.575 A. 

F-6. The added positive potential caused by operating the PCUs introduces negligible 

additional electrical current collection in the EMU in light of the recent EMU electrical 
isolation modifications, even outboard of the SARJ. 

- An analysis was performed by the NESC team of plasma current collection by the 
EMU due to positive ISS potentials with the PCU on. 

- Electron plasma currents have been recalculated accounting for modifications to the 
EMU including those that isolate equipment. 

• Currently, there is no DC condition due to the isolation of the MMWS 
since it is no longer an exposed conducting path. 

- The NESC team calculation used the orbit-limited cylindrical electrical current 
collection model, which is more applicable than the more conservative orbit-limited 
spherical electrical current collection model. 

- An analysis performed by the NESC team showed that the previous calculations of 
thorax electrical current levels used to determine that low positive potentials are a 
hazard, were more than an order of magnitude too large. 

- Electrical isolation of the MMWS has greatly reduced the probability of any potential 
hazard due to DC conditions. 

F-7. The PCU has adequate supply of xenon gas and the hardware (hollow cathode) has 
demonstrated life in space to support its use at the ISS past 2028. 

— Both PCUs satisfy the two necessary conditions for long life: 

• There is enough propellant to run the PCUs past 203 1 . 

- No PCU hardware component has been identified to limit the operational life shorter 
than 2024. 

- In flight hollow cathode experience, DS1, demonstrated >16,000 hours (Test 
Readiness Level 9). Currently on the Dawn spacecraft, the three thrusters and their 
hollow cathodes have a combined >35,000 hours of operation. 

F-8. The modified suit acts as a hazard control by disrupting the electrical current path from 
the ISS through the astronaut to the plasma through multiple layers of insulation. 

- There are several specific features of the EVA suit - tether - tool system each 
designed to interrupt the circuit. 
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— For electrical current to flow through an astronaut requires a simultaneous failure of 
several of these features. 

F-9. The low likelihood of occurrence of coincidental EMU insulation failures in the ISS- 
EMU-plasma circuit necessary for electrical current flow through the astronaut torso 
supports its use as a control. 

- The FP as a known hazard is controlled by the insulated EMU-tool system as 
supported by the calculated low probability of a shock hazard, which considers the 
environment and the electrical current path. 

— The NESC team’s preliminary estimates from the circuit path probability suggest that 
the suit insulation reduces the probability of shock hazard to less than 1 in 10 7 . 

F-10. The array shunting FDIR has not been validated and its use presents risks. 

- There is a risk for high negative peaks (of short duration) when an array segment is 
unshunted in daylight after a FDIR response. 

• Solar array unshunting can occur during EVA. Present flight rules provide no 
guidance when to unshunt arrays. 

• The peak magnitude of rapid charging events due to unshunting the array in 
wake (>105 degrees from RAM) is not known. 

• Presents a potential risk to the ISS power balance. 

• To remain power-positive, unshunting must occur on the order of 10s 
of minutes after FDIR’s response. 

- The array shunting FDIR is considered a complicated algorithm potentially causing 
steady state power level issues as well as unknown and unexpected rapid charging 
events. 

F-ll. Use of the low-risk active hazard controls (e.g., PCUs) becomes optional in the ISS 
NCR-232G guidelines and depends on results from a “short-term plasma forecast” 
assessment issued prior to a planned EVA. The need for active hazard controls therefore 
depends on the ability of the higher risk “short-term plasma forecast” method to 
reliablypredict ISS floating potential prior to an EVA. 

- Reliability of the “short-term plasma forecast” (as described in the ISS-NCR-232G) is 
based on the assumption that low solar activity and benign charging conditions will 
continue for the balance of the current Solar Cycle 24 and all of Solar Cycle 25, 
allowing the persistence of plasma environments over time to characterize charging 
hazards. 

F-12. Discontinuing the use of PCUs in favor of the forecast is not the lowest risk option for 
mitigating EVA shock hazard. 
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— Data shows PCUs fully capable of controlling any potential hazard. They are 
designed to be reliable and have the xenon needed to continue past 2028. 

- The forecast cannot predict all the observed types of ISS charging. 

F-13. There is no written documentation provided as to what is considered a safe voltage level 
with respect to arc generation on an EMU suit. The value of -40V is referenced as a 
vehicle requirement. 

— While the -40V level appears to be used in safety assessments related to the EMU, no 
specific voltage requirement can be found which applies directly to the EMU. 

- The current Hazard Report (ISS-EVA-03 12-AC) does not provide a negative voltage 
level (with respect to the ionosphere plasma) which constitutes a safe operating limit 
for the EMU - in order to avoid arc generation. 

- ISS-NCR-232F and ISS-NCR-232G discuss operation of the ISS vehicle with respect 
to a -40V required limit; however, these reports do not provide any specific 
references to safe voltage limits for the EMU suit. 

F-14. There is no written documentation provided which justifies the “risk acceptance point” of 
-45.5V for the ISS vehicle charging with respect to the ionosphere plasma. Furthennore, 
no information is provided as to the application to the EMU suit of this increased risk 
level. 

— While it is made clear in ISS-NCR-232G that the -45.5V level was established at the 
“1/14/09 SRP,” no information is provided as to how much additional risk for arcing 
occurs when an EMU is charged to -45.5V as compared to -40V. 

- Page 6 of ISS-NCR-232G contains the following statement: 

“At the 1/14/09 SRP, a risk acceptance point of -4 5.5 V was agreed upon by the Panel 
as a final non-negotiable limit for the negative potential. It was believed that the risk 
of increase in voltage was within the realm of engineering judgment acceptance 

- No information about the rationale used to support the -45.5V decision was found in 
all of the documentation reviewed by this NESC assessment team - including official, 
unofficial, and background reports and presentations. 

F-15. There are inconsistencies between the released documented processes (e.g., in the ISS- 

NCR-232G) and what is conveyed by the ISS Space Environment Community verbally or 
via email. 

8.2 Observations 

0-1. This assessment does not include scattered plots with the full set of ISS charging events 
nor sensitivity analysis of the floating potential calculations since there was limited 
in formation available on the PIM3.0 code. 

0-2. The limited information on the PIM3.0 restricted the ability to assess the code’s physics 
and capabilities. 
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0-3. The NESC team did not evaluate the EMU systems (i.e., electrical systems, instruments) 
to understand their susceptibility to the study’s hazards. 

0-4. The analysis in this assessment focused on the current ISS configuration and did not 

attempt to address the effects of proposed configuration changes, such as future Russian 
solar arrays. 

8.3 NESC Recommendations 

The following NESC recommendations were identified and directed towards the ISS 
Environments and EVA Safety teams unless otherwise identified: 

R-l. The ISS-NCR-232G approach should be revised. The NESC team disagrees with the use 
of shock hazard forecasting based on environments and modeling to eliminate the PCU 
usage. (F-l, F-3, F-ll, F-12) 

R-2. Both PCUs should be operated in discharge during the entire EVA regardless of pre-EVA 
hazard severity measurements, short-term ionospheric environment forecasts, or location 
of the EVA. (F-5, F-6, F-7, F-12) 

— This provides two of the required three controls to achieve two-fault tolerance. 

R-3. Evaluate the use of the low probability of the ISS crew contact circuit path (per PRA and 
EMU modifications) as the basis for the third control to achieve two-fault tolerance 
instead of the FDIR. (F-8, F-9, F-10) 

— This includes revising the PRA per preliminary analysis demonstrated in this 
assessment. 

R-4. Reassess the severity of the positive potential hazard based on changes to the EMU 
configuration and the analysis provided in this report. (F-6, F-8, F-ll) 

- EMU “positive shock hazard” is the result of making unrealistic assumptions about 
plasma collection that model the EMU as a bare metal sphere floating in space 
connected with a wire to the ISS chassis ground, then claim that the actual 
configuration of the “EMU cannot be used as a hazard control” for this contrived 
“hazard.” 

— If the floating positive potential is demonstrated and accepted as not a threat then 
YVV orientation as a control should be discontinued. 

R-5. Perfonn a quantitative analysis to detennine whether the rapid charging events exceeding 
-45V constitutes a threat to crew during EVA. (F-3, F-10) 

R-6. If the ISSP continues to use the 14-day forecast and PIM3.0 process, described in ISS- 
NCR-232G, for EVA hazard control planning, then it is recommended to address the 
issues described below. (F-l, F-2, F-3, F-4, F-ll, F-12) 
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- The PIM3.0 code is an engineering tool and would need to be updated to meet the 
NASA software standards (NASA-STD-7009) if it is to be used for EVA safety 
critical decisions. 

- PIM3.0 code should be peer reviewed, documented, and a user’s guide provided. 

- The PIM3.0 input file should be documented to generate plasma hazard assessments 
in both the shock hazard control guidelines and plasma hazard assessments to assure 
configuration control when using the model. 

- FP calculations should have error values assigned to them. 

— The PIM3.0 should be updated to incorporate algorithms for simulating all measured 
data including rapid charging events if these are determined to be a hazard (R-5). 

— Verify the ionosphere environment statistics derived from the IRI-2001 model are 
applicable to the IRI-201 1 model. 

— Forecasting based on persistence of ionospheric conditions is useful for long-term (14 
days) solar array configuration pre-planning, but this could also be accomplished 
using statistical models for range of expected conditions (including worst-case) 

- Alternative sources of ionospheric Ne and Te data (e.g., COSMIC Ne profiles, 
ionosonde Ne values, and GAIM model Ne and Te output) are available for use as 
contingency option for characterizing environment should FPMU data not be 
available. 

R-7. The ISSP should complete a systematic study of all available FPMU data. This study 
should include information on the magnitude of charging events, changes in potential, 
rise and decay times, statistical ranges, and other details as required to fully characterize 
the charging events. (F-l, F-2, F-3, F-10) 

- A yearly review of space weather status and the latest ISS measurements is 
recommended. 

R-8. Develop procedures for terminating or avoiding EVA in the wake of the ISS during 

severe auroral events (e.g., capable of generating frame and surface potentials* in excess 
of-100 to -1000V). (F-l, F-3) 

— Demonstrate the threat by independently verifying the effects of extreme auroral 
charging effects on the EMU. Ground tests have shown surface discharges on suit 
materials in simulated auroral conditions, but no tests have been done to detennine if 
these will affect the EMU. 

- Evaluate auroral charging effects during an EVA with PCUs turned on since the 
PCUs might not offer protection against these rare, but extreme, events in the ISS 
wake. 

- Recommend monitoring geomagnetic indices (e.g., Kp or similar indices) and 
coronal mass ejections (CME) in real-time (at least 1 to 2 hours ahead of EVA). 

If likelihood of severe auroral activity at the ISS, delay or terminate EVA. 
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— Conduct a thorough statistical analysis of likelihood of severe auroral arc at the ISS 
during EVA. 

*PCUs mitigate the ISS frame charging, but will not reduce potentials on insulating 
surfaces 

R-9. Documentation related to EVA shock hazard control needs to be updated to be clear and 
specific in the following subjects. (F-ll, F-12, F-13, F-14, F-15) 

1) PCU utilization 

2) Disable FDIR 

3) Marginalization of positive hazard 

4) PRA 

5) EMU tools isolation 

6) Elimination of YVV 

- The ISS-NCR-232G document should be updated to correct inconsistencies, missing 
references, and other general statements. 

- A complete document review is provided in Appendix C of this report. 

9.0 Alternate Viewpoint 

There were no alternate viewpoints identified during the course of this assessment by the NESC 
team or the NRB quorum. 

10.0 Other Deliverables 

No unique hardware, software, or data packages, outside those contained in this report, were 
disseminated to other parties outside this assessment. 

11.0 Lessons Learned 

No applicable lessons learned were identified for entry into the NASA Lessons Learned 
Information System (LLIS) as a result of this assessment. 

12.0 Recommendations for NASA Standards and Specifications 

No recommendations for NASA standards and specifications were identified as a result of this 
assessment. 

13.0 Definition of Terms 

Corrective Actions Changes to design processes, work instructions, workmanship practices, 
training, inspections, tests, procedures, specifications, drawings, tools, 
equipment, facilities, resources, or material that result in preventing, 
minimizing, or limiting the potential for recurrence of a problem. 
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A relevant factual conclusion and/or issue that is within the assessment 
scope and that the team has rigorously based on data from their 
independent analyses, tests, inspections, and/or reviews of technical 
documentation. 

Knowledge, understanding, or conclusive insight gained by experience 
that may benefit other current or future NASA programs and projects. 

The experience may be positive, as in a successful test or mission, or 
negative, as in a mishap or failure. 

A noteworthy fact, issue, and/or risk, which may not be directly within the 
assessment scope, but could generate a separate issue or concern if not 
addressed. Alternatively, an observation can be a positive 
acknowledgement of a Center/Program/Project/Organization’s operational 
structure, tools, and/or support provided. 

The subject of the independent technical assessment. 

The event(s) that occurred, including any condition(s) that existed 
immediately before the undesired outcome, directly resulted in its 
occurrence and, if eliminated or modified, would have prevented the 
undesired outcome. 

A proposed measurable stakeholder action directly supported by specific 
Finding(s) and/or Observation(s) that will correct or mitigate an identified 
issue or risk. 

One of multiple factors (events, conditions, or organizational factors) that 
contributed to or created the proximate cause and subsequent undesired 
outcome and, if eliminated or modified, would have prevented the 
undesired outcome. Typically, multiple root causes contribute to an 
undesired outcome. 

Supporting Narrative A paragraph, or section, in an NESC final report that provides the detailed 
explanation of a succinctly worded finding or observation. For example, 
the logical deduction that led to a finding or observation; descriptions of 
assumptions, exceptions, clarifications, and boundary conditions. Avoid 
squeezing all of this information into a finding or observation. 

13.1 ISS PCU Report Definition of Terms 

Aurora 

Transient displays of light, often displaying as moving curtains and rays, at high latitudes 
associated with geomagnetic disturbances. 

Auroral region 

Oval-shaped, high-latitude zone centered on the geomagnetic pole, in which aurora are 
most visible. 


Finding 

Lessons Learned 
Observation 


Problem 

Proximate Cause 

Recommendation 
Root Cause 
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Auroral activity 

Usually refers to visible aurora and the particles that create them, but may also refer to 
electrical currents that flow in the auroral region. One measure of auroral activity is 
hemispheric power. 

Auroral boundary 

The high and low latitude edges of the auroral zone, typically 72 degrees (poleward) and 
62 degrees (equatorward). 

Auroral precipitation 

Ioni z ed particles that fall, or are accelerated, into Earth’s atmosphere to create the aurora 
and aid in the flow of electrical current. 

Coronal Mass Ejection 

An eruption in the outer solar atmosphere that sends billions of tons of magnetized 
plasma clouds into interplanetary space. When traveling at high speeds these ejections 
create shocks in the solar wind. Earth-intercept of a CME is often followed by a 
geomagnetic storm. 

Electron volt (eV) 

A small unit of energy that is associated with a particle of a single charge, such as an 
electron or proton, moving through an electric potential of IV. It is equivalent to 
1.602xl0 A -19 J. Highly energized particles may have energies of mega electron volts 
(MeV) or beyond. 

Energetic charged particles 

Charged particles such as energetic electrons and energetic protons, and sometimes 
heavier ions, that have high enough energies to be moving at a significant fraction of the 
speed of light - at least 1 percent of the speed of light. These energetic particles can 
cause ionizing radiation damage spacecraft components and biological materials, such as 
DNA. 

Energetic electrons 

Electrons that are traveling much faster than ambient electrons in the space plasma and 
have the potential for causing ionizing radiation damage to spacecraft and astronauts. 
Glossary/energetic electrons 
Energetic Protons 

Protons that are traveling much faster than typical protons in the space plasma and have 
the potential for causing radiation damage to spacecraft and astronauts. 

Glossary/ energetic protons 
Geomagnetic Kp Index 

The Kp-index is an indicator of the geomagnetic disturbance level in Earth’s mid- and 
high-latitude magnetic field compared to a quiet day. 

Geomagnetic Storm/Space Weather Storm in the Earth’s Magnetosphere 

Disturbances/Changes in Earth’s magnetic field due to changes in solar wind conditions 
typically lasting 3 to 6 days. 
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Kp Index 

The Kp index indicates the magnitude of geomagnetic disturbance on a 0 to 9 scale, with 
zero being very quiet and 9 indicating a major geomagnetic stonn. The index has a 3- 
hour cadence. Higher values of Kp are associated with geomagnetic storming, the 
appearance of auroral lights at lower than normal latitudes, and stronger linkages between 
Earth’s upper atmosphere and magnetosphere. See also the “Kp Indices” Cygnet wiki 
page. 

Magnetosphere 

The region of space dominated by the magnetic field of a star or planet. Earth’s 
magnetosphere takes on a tear-drop shape under the influence of the flowing solar wind. 

Plasma 

Plasma is a distinct phase of matter, separate from the traditional solids, liquids, and 
gases. It is a collection of charged particles that respond strongly and collectively to 
electromagnetic fields, taking the form of gas-like clouds. Since the particles in plasma 
are electrically charged (generally by being stripped of electrons), it is frequently 
described as an “ionized gas.” (http://phvsics.about.eom/od/glossary/g/plasma.htm) 

Space Weather 

Describes the variable conditions in space, due to solar activity and the solar wind. 
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14.0 Acronyms List 

A Ampere 

A/m" Ampere per meter 

AIAA American Institute of Aeronautics and Astronautics 

A1 Aluminum 

B Magnetic Field Strength 

BRT Body Restraint Tether 

BSC Body Seal Closure 

Ccg Capacitance of Solar Array Cover Glass 

Cemu Capacitance of EMU Insulating Coating 

Ciss Capacitance of ISS Anodization 

CAIB Columbia Accident Investigation Board 

CCA Communications Carrier Assembly 

CME Coronal Mass Ejection 

DC Direct Current 

DCM Display and Control Module 

DMSP Defense Meteorological Satellite Program 

EMU Extravehicular Mobility Unit 

EPS Electrical Power System 

EVA Extravehicular Activity 

FDIR Fault Detection, Isolation, and Recovery 

FP Floating Potential 

FPMU Floating Potential Measurement Unit (operational on ISS from August 2006 
to present) 

GAIM Global Assimilation of Ionospheric Measurements (ionosphere model) 

gm gram 

GMT Greenwich Mean Time 

IGRF International Geomagnetic Reference Field 

IRI International Reference Ionosphere (ionosphere model) 

ISS International Space Station 

ISSP ISS Program 

jth Electron Thermal Current 

JPL Jet Propulsion Laboratory 

JSC Johnson Space Center 

KSC Kennedy Space Center 

kWh Kilowatt Hours 

L Length of Conductor 

LCVG Liquid Cooling and Ventilation Garment 

LaRC Langley Research Center 

LeRC Lewis Research Center 

LOC Loss of Crew 
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M&S 

mA 

MDM 

m e 

MMOD 

MMWS 

mm 

ms 

msec 

MSFC 

n 

NCE 

NCR 

NESC 

NEXT 

NLP 

NO A A 
NRB 
NSTAR 
O 

OBS 

ORU 

Pt 

PCU 

PIM 

PRA 

rad 

SAIC 

SAPHIRE 

SARJ 

SRP 

SSP 

SWPC 

T 

TDT 

TVCIC 

U.S. 

v 

V 

v x B • L 

WLP 


Modeling and Simulation 
Milliampere 

Multiplexer/Demultiplexer 
Electron Mass 

Micrometeoroid Orbital Debris 

Modular Mini Workstation 

Millimeter 

Microsecond 

Millisecond 

Marshall Space Flight Center 
Density 

NESC Chief Engineer 
Noncompliance Report 
NASA Engineering and Safety Center 
NASA Evolutionary Xenon Thruster 

Narrow-sweep Langmuir Probe (component of FPMU suite of plasma 
instruments) 

National Oceanic and Atmospheric Administration 
NESC Review Board 

NASA Solar Technology Application Readiness 
Oxygen 

Operational Bioinstrumentation System 
Orbital Replacement Unit 
Total Probability 
Plasma Contactor Unit 

Plasma Interaction Model (Boeing/SAIC ISS charging model) 

Probabilistic Risk Assessment 

Radiation Absorbed Dose 

Science Applications International Corporation 

Systems Analysis Programs for Hands-on Integrated Reliability Evaluations 
Solar Alpha Rotary Joint 
Safety Review Panel 
Space Shuttle Program 

Space Weather Prediction Center (NOAA, source for space environment data) 
Temperature 

Technical Discipline Team 
Television Camera Interface Converter 
United States 

Spacecraft Velocity Vector 
Volt 

Vector cross product of velocity and magnetic field 
Wide-sweep Langmuir Probe (component of FPMU suite of plasma 
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instruments) 

YVV Y-axis in the Velocity Vector 


a 

Sigma 

e 

Electron charge 

sO 

Permittivity of free space 

kB 

Boltzmann’s constant 

XD 

Debye length 

Ne 

Electron density 

Te 

Electron temperature 

Vf 

Floating potential 

vp 

Plasma potential 

pA 

Microampere 
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16.0 Appendices 

Appendix A. Human Current Safety Limits 
Appendix B. Overview of Plasma Shock Hazard to EVA Crew 
Appendix C. ISS-NCR-232G Review 
Appendix D. Tools and EMU Hardware Presentation 
D.l NESC_ISS_Shock_EVA_Actions 

D.2 Modular Baseplate Assembly/Body Restraint Tether/Handrail 
Electrical Continuity Test 
Appendix E Additional EMU Pictures 
Appendix F. FDIR Reference Emails 

Appendix G. Maximum Magnetic Induction Potential Along ISS Truss 
Appendix H. International Space Station Electrical Power Systems Training Manual ISS 
TM 21109 (Section 2.3.4) 

Appendix I. International Space Station (ISS) Plasma Contactor Unit (PCU) Utilization 
Assessment Update: Key Points Summary 
Appendix J. EMU Team Email 


EPS 

Plan 
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Appendix A. Human Current Safety Limits 


DC Current Effects (from IEC TS 60479-1) 


6.1 Threshold of perception and threshold of reaction 


These thresholds depend on several parameters, such as the contact area, the conditions of 
contact (dryness, wetness, pressure, temperature), the duration of current flow and on the 
physiological characteristics of the individual. Unlike a.c., only making and breaking of current is 
felt and no other sensation is noticed during the current flow at the level of the threshold of 


perception. Under conditions comparable to those applied in studies with a.c., the threshold of 


reaction was found to be about 2 mA 


Recommend using the threshold 
for startle reaction since this is 
for EVA. 


Tabl# 13 - T«nt»'curr*frt zon»s for d.c. for harxl to foot pathway - 
Summary of zones of Figure 22 


Zonae 

Boundaries 

Physiological ettucts 

OC-l 

Up to 2 mA 
o/if a 

Sight pnclmg sersanon posshl* when n^nr»j_ Rivaling or 'WtdV olvin; 
(UtfWl Ik* 

DC-2 

2 m A up to 
(uri b 

Irwountary rrr.scuUr cartractiors mat/ osporult* arhsti mjknj trailing or 
ta&eUy atarno curent TYon t>a ue.aJty no hartrdu eHcincM physoogicai 

CWOCM 

DC-3 

Curve p and 

Strong «t%olu*iarv 'ruscuar reacaont ard leverseia HMUMfiCM of 
kfmillon and conducto* of mpti*** n the '«att r*jy occur increasing am 
ruirwrt magnludc and fmo Jwjly no organic damage to be v»pecle«s 

DC-4 *1 

Atweorwr, 

Patho-p^ywdotacal v**c1t may occur sue* a* carb-ac arrest breaevng 
a est ar >s turns or otner c«ll.iai danao* Pioaablity of tenlntuur 
refutation increasing with current rragnoiOe and fine 


‘t**J 

DC-4 1 ProbaMIty cf verlncular fieri lit on r creasrg up b) about 5 % 


rj-fl 

OC-4 2 PtobMiUly cf vwincuar fteniMiXi UP 10 aocul 60 % 


Beyono curvg r. 

OC-4 ) PtobMHHy <r uemnoiaf ffriiMOfi aeo* 50 * 

• For duratnrs of curor flow betaw 200 rrs vcrtno.lar flbnlatKfl is only ntutad wmm tne nJnarshle pa nod rt 
r«i*var« trreshotds are soipassed \% ieqads vorencuar tumuticn ins fquro rwai** to tne enacts of current 
wfich lows in patti ten hand to toet and lot upnard current For o c-.rrerc put ns tne Matt currant factor has 
to t* <orwd»r»3 



Figure 22 - Conventional ONicurren zones of effe<ts of d.c currents on persons 
foe e longitudinal upward current pet* (for explanation see Table 13 | 


11/12/2013 


Jack Rasbury/Wyle/SF 
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Appendix B. Overview of Plasma Shock Hazard to EVA Crew 


fv 

NASA 

w ' F 


Informational Briefing to NASA Engineering and Safety Cente 
“Overview of Plasma Shock Hazard to EVA Crew” 



June 19, 2013 
Jack Rasbury 

Wyle Integrated Science & Engineering 
NASA Space and Clinical Operations Division 
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Agenda 


□ Shock Hazard Limits 

□ Approaches to Defining Hazard Severity 

□ Conclusions 


Note: This presentation summarizes work performed prior to sign-off of 
NCR-ISS-232. 
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Physiological Effects 


Effect feeling 

Direct current 
(mA) 

Alternating current (mA) 

60 Hz 

10,000 Hz 

1501b 

1151b 

1501b 

1151b 

1501b 

1151b 

Slight sensation 

1 

0.6 

0.4 

0.3 

7 

5 

Perception threshold 

5.2 

3.5 

1.1 

0.7 

12 

8 

Shock not painful 

9 

6 

1.8 

1.2 

17 

11 

Shock painful 

62 

41 

9 

6 

55 

37 

Muscle clamps source 

76 

51 

16 

10.5 

75 

50 

Respiratory arrest 

170 

109 

30 

19 

180 

95 

>0.03-s vent, fibril. 

1300 

870 

1000 

670 

1100 

740 

>3-s vent, fibril. 

500 

370 

100 

67 

500 

340 

>5-s vent, fibril. 

375 

250 

75 

50 

375 

250 

Cardiac arrest 

- 

- 

4000 

4000 

- 

- 

Organs burn 

- 

- 

5000 

5000 

- 

- 


Page No. 3 


JackRasbury/281-212-1399 


NESC Request No.: TI-13-00869 



NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

13-00869 

Version: 

1.0 

Title: 

ISS PCU Utilization Plan Assessment Update 

Page #: 

118 of 225 



Safety Limits 


Standard 

Limit (mA) 

Applies To | 

JSC-STD-8080 (Std. E-13) 

0.001 to 0.1 

Bioinstrumentation 

JSC 20483 (Obsolete) 

0.5 to 1 

Bioinstrumentation 

NASA-STD-3000 (Obsolete) 

0.05 to 0.7 (Leakage) 
9.6 to 40 (Let-Go) 

Flight Equipment 

NASA-STD-3001 , Vol. 2 

0.05 to 0.5 (Leakage) 
Defers to IEC 60479 

Flight Equipment 

IEC 60601-1 

0.01 to 1 

Medical Equipment 

IEC 60950-1 

0.25 to 3.5 

IT Equipment 

IEC 60479-1 
IEC 60479-5 

0.5 to 2 (Startle Reaction) 

5 to 25 (Strong Muscular Reaction) 
40 to 350 (Ventricular Fibrillation) 

User Defined 


The standards are sometimes difficult to interpret and apply. 

To date, the IEC 60479 documents have been the most useful. 
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Defining Hazard Severity - Approach 1 


□ Model the human body and calculate hazard currents 
□ Work performed prior to ISS mission 1 5A 
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Body Impedance 


□ Body impedance is determined by: 

□ The contact locations (current pathway) 

□ The contact surface area 

□ Moisture or wounds on the skin 

□ And other factors 



Garment Resistance at Rings 


Current Flow to the vehicle 



• Garment thickness, d ■ 0.3 cm 

• Area of skin contact A" 100 cm2 

• Conductivity oi sweat o o 005560 mhos cm (from Licht. Stern and Sh.vachman) 

• Resistivity of sweat 6 = I O - 180 ohm -cm 

• Resistance = 6 ‘ d i A = 0 64 ohm« 

• For the skin contact area of SO cm2 the resistance would be 9.83 ohms 


Ain 16 15A SORR SLSD Shock Dou 


Oougkn Hamilton Space Me*anc JSC 


□ Internal impedance of the body is 
mostly resistive and concentrated at 
the joints 

□ Human transthoracic impedance 
can range from 25 to 100 ohms 
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Hazard Currents (in mA) 

Broken Down By Tether and Mini-Workstation Only@ Solar Min 


SOLAR MIN 

Wnst 

Lower Arm Rinq 

Body Seal Closure 

Waist Rmq 

Upper Leq Rmq 

Ankle 


BodY Seal Closure or Waist Rmq 

144 

196 

m 

N/A 

208 

144 

NASA STD 3000 Solar Min Tether and Mini-Workstation 

Physioloqical Effect 

1 .2,3.4 .5 

12.3,45 

N/A 

N/A 

123,4,5,6,7 

123.4.5 

Body Seal Closure or Waist Rmq 

86 

9.7 

N/A 

N/A 

100 

86 

NASA STD 3000 Solar Min Tether only 

Physioloqical Effect 

123 

123 

N/A 

N/A 

123 

123 

Body Seal Closure or Waist Rinq 

112 

135 

N/A 

N/A 

139 

112 

NASA STD 3000 Solar Min Mini-Workstation Only 

Physioloqical Effect 

123.4.5 

123.4.5 

N/A 

N/A 

1.23.4.5 

123.4.5 

Body Seal Closure or Waist Rmq 

94 

163 

N/A 

263 

231 

85 

Freiberger Resistances using MWS and Tether at Solar Mm 

Physiological Effect 

123 

12.3.4.5 

N/A 

1.23.4.5.6,7 

123.45.6.7 

123 

Body Seal Closure 

87 

120 

N/A 

160 

148 

82 

Freiberger Resistancesand only MWS at Solar Mm 

Physioloqical Effect 

1.23 

123.4,5 

N/A 

1.23.4.5 

123.4.5 

12.3 

Body Seal Closure 

74 

9.0 

N/A 

110 

104 

7.2 

Freiberger Resistances and only Tether at Solar Mm 

Physiological Effect 

123 

12.3 

N/A 

1,23.4.5 

123.45 

1 23 

Waist Rinq 

9.2 

15.9 

N/A 

N/A 

239 

88 

Freiberger Resistances using MWS and Tether at Solar Mm 

Physioloqical Effect 

123 

123,4,5 

N/A 

N/A 

123.4,5.6.7 

123 

Waist Rinq 

86 

11.8 

160 

N/A 

151 

83 

Freiberger Resistances and only MWS at Solar Min 

Physioloqical Effect 

123 

123.4,5 

123,45 

N/A 

123.4.5 

123 

Waist Rmq 

73 

8.9 

110 

N/A 

106 

7.2 

Freiberger Resistances and only Tether at Solar Min 

Physioloqical Effect 

L13 

123 

U3.43 

N/A 

I^T.4,5 

V3 


Physioloqical Effect 


1 

Trauma Secondary to Simultaneous Involuntary Flexor and Extensor Muscle Contractions 

2 

Simultaneous Stimulation of Central and Penpheral Sensory and Motor Nerve Bundles 

3 

Activate Autonomic Nerve Plexus Causinq Nausea and Vomiting 

4 

Stimulate Spinal Spastic Motor Reflexes InvoMnq Motor Neurons Infenor to the Spinal location of the Sensory Nerve Path 

5 

Significant Startle Response with Involuntary Limb Retraction 

6 

Cardiac Stimulation 

7 

Minimum Cardiac Fibrillation Thresholds 


3 metal collection areas 0.33=Tether, 0.49=MWS and 0.83 Total Area (in square meters.) 
2 densities for solar min: 2x1 0 11 and solar max IxlO 12 nr 3 . 

Jan 22 1 5A Tiger team 2009, Douglas Hamilton 
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Hazard Currents (in mA) 

Broken Down By Tether and Mini-Workstation Only@ Solar Max 


SOLAR MAX 

Wnst 

Lower Arm Rinq 

Body Seal Closure 

Waist Rinq 

Upper Leg Ring 

Ankle 


Body Seal Closure or Waist Rinq 

212 

376 

N/A 

N/A 

438 

212 

NASA STD 3000 Solar Max Tether and Mini-Workstation 

Physiological Effect 

123.45)6.7 

123.456.7 

N/A 

N/A 

12.3.4.5.6.7 

123.4,56.7 

Body Seal Closure or Waist Ring 

190 

318 

N/A 

N/A 

364 

190 


Physiological Effect 

1.2.3,45 

12.3.456.7 

N/A 

N/A 

12.3.4.56.7 

1.2.3.45 


Body Seal Closure or Waist Rinq 

170 

268 

N/A 

N/A 

302 

170 

NASA STD 3000 Solar Max Mim-Workstation Only 

Physiological Effect 

1.23,45 

123.4.56.7 

N/A 

N/A 

12.3.4.56.7 

123.45 

Body Seal Closure 

132 

257 

N/A 

1985 

65: 

121 

Freiberger Resistances using MWS and Tether at Solar Max 

Physiological Effect 

123,4,5 

123.4,56.7 

N/A 

123.4.56.7 

12.3.4.5.6.7 

M3.45 

Body Seal Closure 

11.7 

198 

N/A 

100 1 

413 

109 

Freiberger Resistances and only MWS at Solar Max 

Physiological Effect 

123,45 

12.3,45 

N/A 

123.4.56.7 

12.3.4.55.7 

12.3.45 

Body Seal Closure 

125 

226 

N/A 

1407 

519 

116 

Freiberger Resistances and only Tether at Solar Max 

Physiological Effect 

123,45 

123.4,56.7 

N/A 

123.455.7 

12,3,45.6,7 

12.3,45 

Waist Rinq 

130 

246 

1985 

N/A 

779 

124 

Freiberger Resistances using MWS and Tether at Solar Max 

Physioloqical Effect 

123,4,5 

123.456.7 

123.4,5,6.7 

N/A 

123.456.7 

123.45 

Waist Rinq 

115 

191 

1001 

N/A 

47 7 

111 

Freiberger Resistances and only MWS at Solar Max 

Physioloqical Effect 

1.23,45 

123.45 

123.4.56.7 

N/A 

123.455.7 

123.45 

Waist Rinq 

123 

217 

140 7 

N/A 

610 

118 

Freiberger Resistances and only Tether at Solar Max 

Physioloqical Effect 

M3, 4,5 

M3, 456.7 

123.456.7 

N/A 

123.4.5.6,7 

M3, 45 


Physiological Effect 


1 


Trauma Secondary to Simultaneous Involuntary Flexor and Extensor Muscle Contractions 


2 


Simultaneous Stimulation of Central and Peripheral Sensory and Motor Nerve Bundles 


Actnrate Autonomic Neive Plexus Causing Nausea and Vomiting 


Stimulate Spinal Spastic Motor Reflexes Involving Motor Neurons Inferior to the Spinal location of the Sensory Nerve Path 


Significant Startle Response wrth Involuntary Lrmb Retraction 


Cardiac Stimulation 


Minimum Cardiac Fibrillation Thresholds 


3 metal collection areas 0.33=Tether, 0.49=MWS and 0.83 Total Area (in square meters.) 
2 densities for solar min: 2x1 0 11 and solar max IxlO 12 nr 3 . 

Jan 22 1 5A Tiger team 2009, Douglas Hamilton 
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SLSD Conclusions Priorto ISS Mission 15A 


□ 15A Hazard Currents could: 

• Cause T rauma Secondary to Simultaneous Involuntary Flexor 
and Extensor Muscle Contractions 

• Cause Simultaneous Stimulation of Central and Peripheral 
Sensory and Motor Nerve Bundles. 

• Activate Autonomic Nerve Plexus Causing Nausea and Vomiting 

• Stimulate Spinal Spastic Motor Reflexes Involving Motor 
Neurons Inferior to the Spinal location of the Sensory Nerve 
Path. 

• Cause Significant Startle Response with Involuntary Limb 
Retraction 

• Cause Cardiac Stimulation 

• Reach Minimum Cardiac Fibrillation Thresholds 


2009, Douglas Hamilton 
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Defining Hazard Severity - Approach 2 


□ 3D Computational Modeling 

□ Represents hazard prior to MMWS and OBS mods 
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Naval Health Research Center Detachment Directed Energy 
Bio-effects Laboratory Pilot Study 


Finite Difference Time Domain Model 

The first computational model, calculates the 
distribution of electric fields. 

Spatially Extended Nonlinear Node Model 

The second computational model, the Spatially 
Extended Nonlinear Node model, was used to 
establish action potential thresholds for neurons of 
different diameters 



COS 01 015 02 C2S 03 035 34 006 01 015 02 025 03 OX 04 




Convert calculated E-fields Brooks Man anatomical model with a cutout (left image) 

into Nerv e 4ction Potentials and " ith ski “ ! fat and muscles f emoved (right image). 

2011, Douglas Hamilton 
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Shock Hazard Path in EVA Suit 


Electrode Placement 


& f 


Waist Ring to - 

A. 

IHf l\ Wrist Ring 

% \ 


. \ 

■ % 

m 

Waist Ring to 
Body Seal 
Closure 

M 


Convert calculated 
E-fields into Nerve 
Action Potentials 


E mog V/r 
1.5 

800 
600 
400 
I 20.0 
0.00107 



□ The peak current induced by a 1 5 volt contact was: 

□ 1 8.3 mA for the chest-to-hip current path 

□ 1 5.5 mA for the wrist-to-hip current path 


2011, Douglas Hamilton 
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SLSD ConclusionS Priorto MMWS/OBS Mods 


□ If only the large nerve trunks are considered, it is clear that a 15 volt 
electrical shock to the wrist is likely to cause involuntary left upper 
extremity movement mediated by motor nerve stimulation of 
median, ulnar or radial nerves. 

□ Involuntary motor response in the entire body could be triggered by 
direct stimulation of left upper extremity sensory nerves which may 
trigger a spinal reflex. 

□ Neuromuscular response resulting from direct stimulation of a major 
nerve trunk is unlikely for a15 volt electrical shock if the electrode 
path is from the waist to anterior chest. 

□ The possibility of a startle reaction due to direct excitation of 
cutaneous receptors is large because the induced current was in 
excess of 1 8 milliamps. 
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Comparison to IEC 60479-5 


DC Voltage Effects 

TR 60479-5 © IEC;2007 - 19 - 


Table 2d - Startle reaction for direct current 


Startla reaction 




OC touch voltaga thraaholda for long duration 



thrathold 

mA 

Saitwatar-wat 


Valor, .vat 



Ory 




Larga 

contact 

Uadium 

contact 

Small 

contect 

Larga 

contact 

Madnim 

contact 

Small 

contact 

Larga 

contact 

Medium 

contact 

Small 

contact 

Hano-to-nand 

2 

2 

4 

'2 

3 

t2 

Sf 

7 

23 

79 

Both-nonoi-t©- 

l»H 

2 

1 

2 

• 

2 

T 

35 

4 

19 

59 

Hand-to-ttat 

2 

t 

2 

• 

’ 

6 

2* 

3 

12 

39 


Table 2# - Strong muscular reaction for direct current 


muacular 

•ffacta 

Ihroatiold 

OC loucti 
Sa-t-atar.-at 

voltaga tnraaholda for long 
Watar--at 

duration 

Ory 

Larga 

contact 

Madium 

contact 

Small 

contact 

Largo 

contact 

MtOiwm 

contact 

Small 

contact 

Larga 

contact 

Madium 

contact 

Small 

contact 

Hano-io-nand 25 

Boih-hand»-lo- 

faat 

Mana-lo-»aat 25 

24 

44 

<12 

29 

•< 

156 

43 

69 

156 

13 

23 

S3 

16 

5< 

133 

26 

67 

133 

12 

22 

54 

15 

41 

76 

2< 

45 

79 


AC Voltage Effects 

Table 2a - Startle reaction for alternating current 50/60 Hi Table 2b - Strong muscular reaction for alternating current 50/60 Hz 


Startla raactlon 




AC touch voltaga thraaholda lor long duration 

V 




Muacular 

affacta 




AC touch voltaga thraaholda for long duration 

V 



Currant 

ihraahold 

mA 

Salt-alar— 



Watar-.a 



Ory 



Currant 

thraahotd 


Satfwatar— 



Volar- -at 



Dry 




Larga 

contact 

Madium 

contact 

Small 

contact 

Largo 

contact 

Madium 

contact 

Small 

contact 

Larga 

contact 

Madium 

contact 

Small 

contact 




Larga 

contact 

Madium 

contact 

Smat 

contact 

Larga 

contact 

Maerum 

contact 

Sman 

contact 

Larga 

contact 

Madium 

contact 

Small 

contact 

Hand-to-hand 

0.5 

i 

1 

3 

' 

4 

2i 

2 

9 

40 


Hand-to-hand 

9 

9 

9 

27 

t 

29 

93 

11 

40 

104 

B©lh-nana»-to- 

toat 

0.5 

0.3 

< 

2 

0.4 

3 

13 

• 

9 

23 


Both-handt-to- 

taat 

10 

9 

9 

27 

7 

25 

93 

11 

40 

104 

Mand-to-aaat 

0.9 

0.3 

0.9 

2 

0.4 

2 

11 

1 

4 

20 


Hand-to-taal 

9 

3 

9 

13 

3 

13 

46 

6 

20 

52 


Page No. 14 


JackRasbury/281-212-1399 


NESC Request No.: TI-13-00869 


@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

13-00869 

Version: 

1.0 

Title: 

ISS PCU Utilization Plan Assessment Update 

Page #: 

129 of 225 


Appendix C. ISS-NCR-232G Review 

REVIEWER/Date: Albert Whittlesey, JPL, 2/13/14, 

member of NESC ISS Plasma Contactor Unit (PCU) Utilization Plan Assessment Team 
(shortened to "NESC Team,” or usually "The Team" in this review). 

COMMENTS TO: 

REPORT NUMBER: ISS-NCR-232G 

REPORT TITLE: Lack of Two-fault Tolerance to EVA Crew Shock in the Low Earth Orbit 
Plasma Environment 

REPORT AUTHOR: The Boeing Company Space Exploration International Space Station, 

DATE OF ISSUE: Sept. 27, 2013, signed by Scott I. Wolf 

Background/Introduction: 


Block 12: Section A. Applicable Requirement: 

SSP 410001 System Specification for ISS 
Paragraph 3. 3. 6. 1.1.1 1 Catastrophic Hazard 

The on-orbit Space Station shall be designed such that no two failures, or two operator errors 
(see 6. 1 ), or one of each can result in a disabling or fatal personnel injury, or loss of one of the 
following: Orbiter or ISS. 

SSP 41162 Safety Requirements for ISS 
Paragraph 3. 3. 6.1. 1.1 1 Catastrophic Hazards 

The USOS shall be designed such that no two failures, or two operator errors (see 6.1 ), or one 
of each can result in a disabling or fatal personnel injury, or loss of the (Arbiter or ISS. 


No comment. 


Block 13: Section B. Description of noncompliance: (specify how the design or operation does 
not meet the safety requirements): 

NEGATIVE POTENTIALS, Cause 1. 


I have difficulty reading and interpreting the cases involved and how to read and 
understand Attachment 1 as it supports the text in this Block/Section. In spite of that, I 
make the following observations. 
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1. The second row of numbers is 38.8, 29.7, 25.7, and 33.5 

From looking at Attachment 1, it looks like the second number should be 29.8: 

33.8, 29.8, 25.7, and 33.5 

It does not matter in a technical sense but it hinders my understanding of what I should be 
reading as support for the text. 

2. Why are the two numbers 40.8 and 40.7 highlighted in red? It can't be because they 
exceed the 45.5V requirement. I think it is because they are between 40 and 45.5V, as 
noted in attachment 1. I think a yellow background highlight of the numbers would have 
been more meaningful. Also see "Block 15: Section D, paragraph 10: "At the 1/14/09 SRP, a 
risk acceptance point of -45.5V was agreed upon by the Panel as a final non-negotiable limit 
for the negative potential." There appears to be an inconsistency between -40V and -45.5V 
as a hazard limit. Which is correct? 


3. "The largest accepted charging violation is -45.5V.” 


Is it permissible to have a waiver based on a prior waiver? In that case, the 40.8 and 40.7V 
would be permissible on a waiver basis. 

4. Apparently the numbers shown in Attachment 1 were generated by PIM3.0. The NESC 
Team has difficulties with PIM3.0, based on the lack of documentation of the code itself, 
and the input parameters used for any given use of the code. I don't know if the numbers in 
attachment 1 are adequately thus documented in the attachment 1 reference, EID684- 
13598, Rev. B (not examined). 


POSITIVE POTENTIALS, Causes 2 & 3. 


1. Attachment 2 notes that ISS potentials near the truss extremities can reach + 11.9V per 
EID684-15543. The two paragraphs note that these voltages could "create a shock hazard," 
and there are "no certified controls to protect against this hazard." Furthermore, this 
section states that "The EMU is not designed or certified to insulate against electric shock 
per hazard report EMU-018." Specifically, the "most likely path is between the Modular 
Mini Workstation (MMWS) and the Display and Control Module (DCM). We have been told 
repeatedly that most of the EMU metallic parts visible on the surface of the EMU are now 
carefully covered before and EVA and thus cannot be a current contact point. Additionally, 
the MMWS is isolated as a possible current flow path into the astronaut (see Attachment 5 
as an example). As the team understands it, the only metallic outer path into the astronaut 
either from a galvanic contact or from a plasma connection is the (anodized) neck ring or 
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other parts of the headgear, none of which permit a current path through the thorax of the 
astronaut, which is the most sensitive path for shock hazard. 

2. "Bird on a Wire" (Kramer, 2007) uses certain curves to estimate the possible plasma 
current into exterior metal parts of the EMU (pages 37-38). The Team has examined these 
curves and found that alternate conservative estimation equations to estimate thorax 
current are more appropriate and have been validated by the FPMU, that substantially 
reduce the estimated currents from a neck ring and the current thus calculated current no 
longer exceeds the applicable safety limits (Katz, et al., 2013), even when positive voltages 
are as high as 15V (calculated only to +15V, but the positive voltage can be higher and still 
be safe). 


Block 14: Section C, Reason requirement cannot be fulfilled: 
NEGATIVE POTENTIALS, Cause 1. 


See above for rationale why -40V can be exceeded. 


POSITIVE POTENTIALS, Causes 2 & 3). 


See above for rationale why Positive potentials will not be a problem. 


Block 15: Section D Acceptance Rationale 


NEGATIVE POTENTIALS, Cause 1. 

1. The present depressed Solar Cycle 24 is limiting charging levels on ISS due to the hotter electrons collecting on 
the solar array cover glass and producing a potential barrier. This barrier prevents electrons from collecting in the 
solar array gaps and charging the ISS. The Space Environments community has concluded that, based on the 
downward trend of recent Solar Cycles, the environment will remain benign at least through Solar Cycle 25, which 
extends through 2030. FPMU measurements since 2007 have indicated no ISS charging in excess of -45 V. 


Prior attempts to predict the magnitude of any given solar cycle have failed sometimes to a 
great degree. Basing future estimates of the future charging of the ISS on this basis is folly. 

In any given solar cycle regardless of how strong it is, can have one or more large sunspots 
that can create huge ISS charging events, even if the cycle itself if generally low. 

Making environmental ISS potential predictions on this basis for another 17 years is quite 
unwise. 
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2. The ISS floating potential will be verified by a "short-term plasma forecast, ” issued 14 days prior to a planned 
EVA. For the negative potential hazard for EVAs that are conducted entirely in-board of the SARJ. PCUs can be 
placed in discharge even though the ISS charging environment in the current 

depressed solar cycle does not require it. Because the PCUs are optional, enabling the autoshunt FD1R is not 
required. 


Assuming that the environment will be the same 14 days from what is today, although 
generally true, is not adequately true to always use that estimate as gospel for the actual 
day of a planned EMU. The Team agrees that a FDIR is not an appropriate control (but for 
other reasons). 


3. The "short-term plasma forecast" assessments: (1) utilize planned EVA solar array positions, vehicle attitude, 
etc. (2) use "short-term" in-situ ionospheric FP MU measured plasma properties to assess present state of 
ionosphere (e.g., to determine if it is a nominal or + 1 - 1 or 2 a environment as compared to the International 
Reference Ionosphere II AI\ model\, and (3) are based on the assumption that the ionosphere will not undergo 
significant changes over a period of a few weeks (assumption confirmed with considerable FPMU data). In 
addition, the forecasting process includes space weather solar events (i.e., enhanced solar activity, CMEs, severe 
solar flares) and are addressed/monitored in real time. 


This section does not include a reference as to where this forecast process is documented. 

Utilizing the estimate that the ionosphere will not undergo significant changes over a 
period of a few weeks has not yet been verified to be a true assumption. The only way to 
properly verify the ISS state of charge on the day of the EVA is to use the FPMU. The 
forecasting process uses the data inputs as described above and then computes the ISS 
potentials based on a computer code called "PIM3.0." PIM3.0 has been shown to have 
unexplained differences that are far beyond the 1 or 2a variance when the calculated 
potentials are compared to the FPMU measurements. At present, the PIM3.0 code as not 
been adequately validated (NASA coding standards for its use as a personnel hazard 
protection). 


4. It should be noted that certain events that occur after the forecast is issued may invalidate the "short-term 
forecast" (e.g., the solar array plan changes, reboosts. Debris Avoidance Maneuvers). Also, if an event occurred 
that was not anticipated after the forecast was issued. The "short-term plasma forecast" would be declared Invalid. 
Reference Flight Rule 89-908 Plasma Hazard Mitigation During EVA. 


The team agrees with this statement. The prior concerns still apply. 

Paragraphs 5-9 in this section deal with "short-term" (meaning on the order of 14 days) 
"forecast predicts" (meaning calculations of today's ISS charging potentials). They suggest 
that for extraordinary circumstances raising the ISS potentials above those deemed 
acceptable, turning on the PCUs and executing the "autoshunt function" (meaning FDIR?) 
will be used to control ISS potentials. The team agrees that turning on the PCUs is 
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appropriate but disagrees that the FDIR is the appropriate third control for controlling ISS 
potentials to less than hazardous potentials. 

Paragraph 10, stating that -45.5V has been accepted as a non-negotiable risk has been 
earlier noted that it is not consistent with an earlier implication that -40 V is still the limit 
for non-hazardous ISS potentials. 

Paragraph 11, the probabilistic risk assessment summary, is based on ISSPRA-12-56 and 
summary probability numbers are shown in Attachment 3. A PRA expert has examined - 
12-56 at the request of The team and notes that at best, the -12-56 PRA is not adequately 
documented to determine whether its results are consistent with input assumptions, nor is 
there enough detail/transparency to verify the accuracy of the stated outcome 
probabilities. 


DC POSITIVE POTENTIALS, Cause 2. 

Placing the PCUs In discharge produces positive potential hazard in+ 10 to + 12V range 
outboard of SAAJ (i.e., catastrophic hazard). Without PCUs in discharge potential at the truss, 
tips may experience only + 1 to +2 volts. 


The team has examined the basis for report's statement of "catastrophic hazard." The team 
has used newer plasma physics equations as reported separately in this report showing 
that more exact equations sometimes called "2D," still with generous margins, show much 
lower possible plasma accumulation currents than were reported in "Positive Voltage 
Hazard...." (Kramer et al., Sept 2010). With as much as +15V potential on the ISS structure, 
the astronaut's EMU currents will be much less than the Kramer calculations show for 3V, 
and are nominally safe by the hazard curves of "Bird on a Wire" by Hamilton and Kramer, 
August 29, 2007, slides 11-17. 


For the positive potential hazard, the PCUs will not be put into discharge for all EVAs out-board 
of the SARJ. The short-term forecast will be utilized to verify the ISS floating potential 
environment and in the event of hazardous charging levels that necessitate PCU use during the 
EVA. ISS will be maneuvered to a YVV attitude which eliminates the hazard. IfYW is 
undesirable for technical reasons or there is insufficient time to change ISS attitude and there is 
significant programmatic risk in delaying the EVA, the rationale below can be utilized: 


The team disagrees with the rule to not put the PCUs into discharge. The team, by contrast, 
believes that the best policy is to put the PCUs into discharge during the full EVA. The team 
recommends that the "short-term forecast" is OK for initial planning, but needs 
supplemental ISS charging determinations as the EVA nears and during EVA. 
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In order for the circuit to be completed, several events must occur simultaneously: (1) The EVA 
crewmember must be at a positively charged location on the ISS truss; (2) The EMU must make 
galvanic contact with ISS; (3) The exposed bare metal of the EMU must be collecting charge 
from the ionosphere; (4) The crew must make galvanic contact with bare metal in the EMU 
interior; and (5) The overall circuit impedance must be low enough to allow a harmful current 
level. These five events are discussed individually below, {with AW’s comment about each} 


1) The VxB.L potential is only at outboard locations and varies with the orbit. 


The team agrees. 


2) The medical team assessed possible locations of electric shock on January 12-13, 2009, 
with a number of points of possible galvanic contact. They are shown in attachment 4. 


The NESC team has been led to believe that very few, if any, of the stated possible locations 
of possible galvanic contact exist after suit modifications. The team supposedly has been 
provided with up-to-date information which is odd, since the NCR -232G is dated Sept 17, 
2013. This discrepancy needs investigation. 


A Probabilistic Risk Assessment (PRA) (ISSPRA-12-56, May 7, 2013) was performed with 
the suspect metallic contact regions included as part of the relatively risk-ratings (before 
and after MMWS modification) shown in that document. 


The team, again, believes that the galvanic contact regions assumed in the PRA are 
inappropriate and outdated and the PRA at the very least needs redoing with new 
assumptions. Additionally, the team had the -12-56 report reviewed by a PRA expert, who 
found its contents to be unreviewable due to lack of completeness. For human safety 
ratings, one would expect better. 


3) 232G suggests that the Body Seal Closure, the Mini Workstation, the Body Restraint 
Tether, and the waist ring, all of which total collecting area sums to 0.8 m A 2. 


The team again finds this a large area, more closely fit by 0.3 m A 2. 


4) 232G assumes good galvanic contact inside the suit to the astronaut by sweat-soaked 
undergarments and LCVG. 


The team agrees. 
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5) 232G notes that the magnitude of current through a crewmember body depends on the 
body impedance. 


The team agrees, and believes this is built into the safety limit curves in various locations. 


6) 232G notes that the MMWS has been modified to isolate the MGA and swings from the 

baseplate, but only suggests "a significant reduction in the current level " See attachment 

5 for isolation modifications and Attachment 6 for the pre- and post-modification current 
levels. 


The team notes that the -232G is not very clear, is difficult to read, and thus is subject to 
uncertainties. For one example, 3) above notes that a total collecting area was calculated to 
be 0.8 m A 2, but the Tables in Attachment 6 have at most 0.3 m A 2 collecting areas in the 
tables, even for "before MMWS modification." As another example, Attachment 4 has a 
diagram of "External EMU Metal Surfaces" that is not compatible with the separate text in 
the PRA -12-56 (which has at least two additional possible external ISS contacts: CCA 
Connector?-what is this?; and OBS/DCM). As a third example, we are told numerous times 
that the EMU has had numerous modifications, and yet in Attachment 5, only the two 
MMWS components are described. The report would have been better served if each of the 
9 external contact points in -232G Attachment 4 (11 external contact points used in the 
PRA -12-56 Table 3) had been listed in a table, showing the original non-isolated condition, 
and the post-isolation condition and what the improvement was (ohms before and ohms 
after), and when it was implemented. 


TRANSIENT CAPACITIVE DISCHARGE POSITIVE POTENTIALS, Cause 3. 

The likelihood of manifesting the +transient capacitive discharge current is comparable to that 
of the +DC current. Likewise, the MMWS modifications provide mitigation for this hazard as 
well as the +DC hazard by removing the largest and most likely contact point from the 
capacitance circuit. Further mitigation of this hazard in the Assembly Complete ISS 
configuration can be provided by taping the Operational Bioinstrumentation System (OBS) 
connections inside the EMU with Kaplan to electrically isolate the crewmember from the EMU 
single-point ground (Ref. CR EVA-01 168). 


The team has not heard specifically if the OBS connector inside the EMC is normally taped with 
Kaplan (sic) (?Kapton®). The team has been told that all possible galvanic connections on the 
outer surface of the EMU are covered with fabric flaps or are taped (with the possible exception 
of the neck ring or other head area connections). The team has not seen a specific list of regions 
that are non-compliant to the general claim of "no galvanic connections from outside the EMU to 
the astronaut.” 
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PRA Updates and Results 

The P6 IEA battery R&R task performed on Flights 2J/A and ULF4 represents a "worst-case" 
EVA from an exposure standpoint. The TCS jumper installations, venting and refill of the P6 
PVTCS radiator on Flight ULF6 represent a comparable level of exposure. For analysis 
purposes, it was estimated that approx. 80% of such an EVA would be spent outboard of the 
P1/P3 interface, i.e., 5:12 of a 6:30 EVA duration. This is reflected in the PRA calculations 
(Ref. ISSPRA-12-56). See Attachment 3 for the PRA event flow model and PRA results. 


The team has not examined this situation and cannot comment. 


The PRA was updated to account for the + transient capacitive discharge hazard as well as the 
mitigation provided by modifications made to the Modular Mini Workstation (MMWS) to 
electrically isolate it from the Baseplate/BSC. For the Assembly Complete ISS configuration, the 
PRA also modeled the mitigation provided by isolating the OBS connections inside the EMU to 
prevent contact with the crewmember. The results of the updated PRA are as follows (numbers 
are rounded): 

+ Transient Capacitive Discharge Hazard 

(A) The mean probability of a shock event for 1 crew member on a single EVA is 5.11 E-05 (1 -in- 
19. 57 3). 

(B) The mean probability of a shock event for 1 crew member on a single EVA with the OBS 
isolated is 7.00E-07 (l-in-1.428.367). 

+DC Hazard 

(C) The mean probability of a shock event for 1 crew member on a single EVA is 4. 75E-05 (1 -in- 
21, 07 5). 

(D) The mean probability of a shock event for 1 crew member on a single EVA with the OBS 
isolated is 6.63E-07 (1-in-l .509,206). 

The Baseline EVA Risk from all other hazard causes for 2 crew members on a single EVA is 
3.86E-05 (1 -in-2 5. 920). 


The team obtained the services of a senior person with excellent PRA credentials and asked that 
person to review the -12-56 PRA. 

That PRA expert did not have the time to adequately read and verify the total product. In fact, 
The team was only given a brief summary of the appearance of the document as it appeared to 
him. That report is provided in another section of The team's report (of which this section is a 
part). The summary was that it was difficult to properly track and validate the report's contents. 
However, it did not appear to provide total auditable verification of the results reported (numeric 
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probabilities and error bars of the occurrence of various events). Numeric outputs of the PRA - 
12-56 are copied into the probabilities locate immediately above this paragraph. 

Further, not to quote the PRA expert, but if the team or the ISS wishes to use this PRA (and - 
232G quotes the PRA extensively to support its conclusions), then the PRA -12-56 should also 
have a good peer review to validate its assumptions (including basic probability assumptions) 
and proper use of the specific PRA computer code recognized by the Team's PRA expert). 


In conclusion, while there are multiple current paths through the EMU/crewmember that can 
result in catastrophic effects if the circuit is established, modifications to external conductive 
EMU equipment have reduced the current associated with the +DC and +transient capacitive 
discharge hazards 

The likelihood of occurrence is comparable to other previously accepted risks. 


This conclusion, although weakly stated, is the same one reached by the team: a re-assessment of 
the risk during an EVA is much reduced because of the changed EMU suit design to isolate most 
of the possible current attachment paths into the body of the astronaut, and by comparison to 
other previously accepted risks. 

The team’s additional recommendations to operate the PCUs during an EVA (two hazard 
controls); and not use the EVA shunt FDIR logic (possible hazardous FDIR responses in some 
situations); and to treat the EMU’s isolation modifications as a third hazard control, all are 
compatible with the -232G conclusion above. 
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Appendix D. Tools and EMU Hardware Presentation 

D.l NESC_ISS_Shock EVA Actions 

D.2 Modular Baseplate Assembly/Body Restraint Tether/Handrail 

Electrical Continuity Test 


NESC Request No.: TI-13-00869 



NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

13-00869 

Version: 

1.0 

Title: 

ISS PCU Utilization Plan Assessment Update 

Page #: 

139 of 225 


D.l NESC ISS Shock EVA Actions 



EVA Action Items: Provided Documents 


EMU Externally Induced Hazard Report 

• EMU-0 1 8 .pdf (cause E 1 and E2) 

BRT to MMWS Baseplate Continuity Test Summary 


• Baseplate-BRT Continuity test Summary .ppt 

US EVA 21 IMMT Environments presentations 

• Plasma Hazard Discussion for EVA 2 1 .pptx 

• US_EVA_21_Mayl l_2013_plasma_forecast_memo.doc 


1 
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EVA Action Response: Tools and EMU hardware 


MMWS Base Plate: 

• Was a resistance requirement added? 

• Yes, req 3. 1.5. 6 was added to the CARD “Forthe -305 configuration modular baseplate, no 

conductive path shall exist between the baseplate and both the pivot latch receptacles and the tether 
ring. 


• This requirement is verified at Pre-Delivery Acceptance, Pre-Installation Acceptance and Qual via 
ohm meter. 

• Number of on-orbit units: 3 

• Number of ground spare units: TBD 

BRT: 

• Was the BRT isolated? 

• No, tlie project concluded, via test, there is no continuity through file BRT to the MMWS Baseplate. 
(Summary presentation “Baseplate-BRT Continuity test Summary .ppt”) 


EMU: 

• Are the EMU connector and sizing rings coated? 
• Yes. all aluminum carts are clear anodized. 
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EVA Action Items: Pictures 
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D.2 Modular Baseplate Assembly/Body Restraint Tether/Handrail 
Electrical Continuity Test 


OTTE 

V 

A 


Modular Baseplate Assembly / Body Restraint 

Tether / Handrail 

Electrical Continuity Test 


ONE EVA -Miguel Castillo 
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Background 


OTTB 

V 

A 


□ Sponsor: 

• OneEVA 

□ Description and History 

• To assess the likelihood of further 
reducing the potential shock hazard to an 
EVA Crewmember created by exposure 
to a plasma charged environment, One 
EVA was tasked with performing an 
electrical continuity test on 3 tool 
assemblies 

• The 3 tools stack-up was as follows: 

S Modular Baseplate Assembly (S/N: 1022) 
✓ Body Restraint Tether (BRT) (S/N: 1003) 
S Handrail 

• Tube Drop (no anodize layer) 

• Assembly (gold anodized) 



Figure 1 - MMWS Tool Stack-up 
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Data 


OISOB 

V 

A 


□ TPS 1011EV175 

• Using a multi-meter, verify electrical continuity exists between the following 
components: 

v" Baseplate Conical Housing to MUT/BRT Mounting Boss: Left:l Yes l/ No Right:l Yes l/ No 
v' BRT Mounting Housing to End Effector (EE) Trigger: Yes /I No I 

v" Handrail wineglass bottom to scratched Tube surface [Yes] / No 

• Record electrical resistance of the following interfaces: 

s BRT Tapered Housing to Stainless Steel Triggerinside the EE Jaws >OL(Figure2) 

v' Modular Baseplate Tapered Housing to Triggerinside the BRT’s EE Jaws -» OL (Figure 3) 

v' Modular Baseplate Tapered Housing to one of the Hardrail Tube Drop Ends>OL (Figure 4) 

s Modular Baseplate Tapered Housing to Hardrail Wine Glass bottom surface>OL (Figure 5) 

Note: According to the Fluke Model 179 Multimeter’s user’s manual, when measuring resistance OL > 
50 MQ 

Note 2: When measuring continuity on the BRT, a resistance value was only observed when 

interfacing the Tapered Housing to the first Rotating Dial and when interfacing the Triggerto 
either of the two Depress Levers. Any other Stainless Steel surface inside of those components 
were non-conductive when measuring from either the Tapered Housing or the EE Trigger 
(Figures 6 - 9). 
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Pictures 


OTTE 

V 

A 



Figure 2 - BRT Housing to EE Trigger 



Figure 4 - Baseplate to un-anodized Handrail 



Figure 5 - Baseplate to anodized Handrail 
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Pictures 
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Figure 6 - BRT Housing to 1 st Rotating Dial 





Figure 7 - BRT Housing to 2 nd Dial 




Figure 8 - BRT2 nd Dial to EE Base 


Figure 9 - BRT EE Base to EE Trigger 


Page No. 5 


ONE EVA - Electrical Continuity Test 


Miguel Castillo - 05/04/10 


NESC Request No.: TI-13-00869 




@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

13-00869 

Version: 

1.0 

Title: 

ISS PCU Utilization Plan Assessment Update 

Page #: 

151 of 225 


CXNTE 

Conclusions and Recommendations Y 


□ Conclusion 

• Electrical Conductivity test determined that in the BRT no 
continuity could be observed when attaching a multimeter between 
the tapered housing and the Trigger inside the End Effector Jaws 

• Furthermore, no electrical resistance value of could be recorded 
when attaching the BRT to a Modular Baseplate and either an 
anodized or an un-anodized Handrail 


□ Observations 

• Although no resistance value could be recorded on this particular 
BRT, previous BRT design verifications have shown that a 
conductive path can be created between the various mechanisms 
inside the assembly, mainly by threading into Stainless Steel and 
anodized aluminum components 
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Appendix E. Additional EMU Pictures 



EMU Overview and Sizing 


February 3, 2006 


1 
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; if/ft: 

|| EMU Sizing - Agenda 


The purpose of this overview is to inform the reviewers of: 

* Components of EMU 

• Suit f itcheck process and the basics of an optimal suit fit 
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EMU - Overview ^ 



The EMU is the interface between the Crew Member and the EVA 
environment 

- Provides a protective barrier against natural environment 

- Supplies oxygen for breathing and circulates w ater for cooling 

Space Suit Assembly (SSA) - 

anthropomorphic pressure vessel that encloses 
the crewmember 

Life Support System (LSS) - backpack containing 
consumables needed to sustain crewmember 

Thermal Micrometeoroid Garment (TMG) - 

Different layer garment covering EMU provides 
protection against radiation and micrometeoroids 

Simplified Aid for EVA Rescue (SAFER)- 

propulsive jetpack used for self rescue 
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EMU - Overview j 
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EMU- Helmet/ Extravehicular Visor Assembly (EVVA) 



Helmet Components: 

- Clear polycarbonate bubble 

- Neck ring 

- Ventilation pad 

- Helmet purge valve 

EVVA Components: 

- Protective visor 

- ©old visor 

- Sunshades 

One standard size 
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fijf if 

1 EMU- HUT \ 



Planar HUT: rigid fiberglass structure surrounding the upper torso 


• All other major components of the EMU are attached to the HUT 

• Components: 

Neck ring 

Body Seal Closure (BSC) 

Waterline and Vent Tube Assembly (WLVTA) 

• Medium, Large, X-Large 

• All sizes use standard 16" BSC 

• On orbit replaceable unit (ORU) 

• Scye bearings canted forward 

• Shoulder movement is limited 
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EMU - Arm Assembly 



• Components: 

- Upper arm: allows shoulder mobility 

- Lower arm: allows elbow/wrist mobility 

- Sizing ring: 0.5" if required 

• Nine sizes of lower arms 

• Cam brackets provide additional 
adjustment 
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8. Short EMU sizing adjustment ^ 



2” Delta 



1/4" 


1/2 ” Connected 


Lower Arm Upper Arm 

Segment Segment 

Arm Ring 
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EMU Phase VI Gloves - Overview 



* Purpose: 

- Acts as interface between the Crewmember and associated task 

- Provides protective barrier against natural environment 

• Components: 

- Bladder 

- Restraint 

- TAAS 

- Wrist Tether Strap 

- Wrist Disconnect 
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EMU - Phase VI Gloves 



Phase VI Gloves 

• Variety of existing and custom sizes 

• Dual axis, two ring wrist gimbal design 



10 
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EMU Phase VI Gloves - Restraint 





Palm Bar Strap 

• Palm bar and palm plate prevent pressurized glove from ballooning out 

* Tension adjusted via buckle on back of hand under glove TMG flap 


Palm Bar 
Palm Bar Strap 

Palm Bar Buckle 


Palm Plate 


ll 
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EMU - Lower Torso Assembly (LTA) 



• Components: 

- Waist brief assembly 
Leg Assembly 
Boots 

Sizing rings (if required) 

• Waist brief assembly: connects 
HUT to LTA via BSC 

• Thigh sizing ring: 0.5" 

• Leg sizing ring: 0.5", 1.0", or 1.5" 

• Boots: 

- Limited sizing due to foot 
restraint 

- Heel has slot to fit in foot 
restraint 
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; if/ft: 

|| LTA sizing adjustments 
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EMU -Waist Brief Assembly 



• Two types of waists 

- Adjustable Waist: used for 
flight and provides resizing 
capability 

- Standard Waist: mostly used 
for NBL training and has 5 
sizes 

* Resizing involves manipulation 
of pins, axial restraints and 
webbing 
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EMU-Leg Assembly 



Encloses middle part of leg 

Four sizes of legs 

Two cam brackets offer 
additional sizing (0.5" x 2 = 1" 
total) 

Knee joint provides flexibility 
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Two sizes of boots 

Boot Sizing Inserts (BSI) with 
Toe Caps provide foot indexing 
within the boot and thermal 
protection. 

If BSI not worn, then thermal 
slipper sewn onto L CVG 
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EMU- Liquid Cooling Ventilation Garment 

(LCVG) 



Nylon cloth with clear and yellow tubing 

Liquid cooling tubes maintain desired 
body temperature 

Vent ducts at extremities send oxygen to 
primary life support system for 
conditioning 

Seven sizes with additional adjustments 

Comfort pads reduce pressure points or 
take up free volume in the EMU. 


17 



Extensions 


Vent 

Ducts 
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EMU- Communication Corner Assembly 
(CCA) 

Components: 

- Crew/ Communications Electronics Module (CCEM) 

- Neck or Chin Strap 

- Sweat Band 

- Ear Cups. 

Six sizes CCAs 

CCEM contains the microphone booms 
Redundant mic booms and ear pieces 




CCEM with 
Mlc booms 
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EMU- Disposable In-Suit Drink Bag 
(DIDB) 

• Stores 32 oz drinkable water in the HUT 

• Filled through the Station/Shuttle galley 

• Contained in a restraint bag 

• Twisting the bite valve can lead to leakage 

• Straw may be repositioned 




a--v"T 


Bite Valve 
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EMU-Ancillary Hardware 



Comfort gloves: 

- Worn under EMU gloves 

- Provides added comfort 

- Allows easier donning/doffing 

- Wicks away perspiration. 

Thermal Comfort Undergarment (TCU): 

- worn under the L CVG 

- undershirt and underpants 

Maximum Absorbency Garment (MAG): 

- super-absorbent undergarment worn during EVA 

Crew Preference and Options Document: 

- Valsalva, Fresnel Lens, Socks, Wristlet, sports bra, etc. 



H 
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EMU - Examples of Ancillary Hardware 



VALSALVA 


? 



MODIFIED ORIGINAL 

(MV) 

FRESNEL LENS 

TCU 


A C 


SOCKS 



MAG 



WRISTLET 


Read the Crew Preference and Options Document 
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(Hi SAFER 



• Provides contingency self rescue capability 

• No redundancy 

• Accommodates rescue when Orbiter is unavailable 

• Utilizes 6N2 thrusters 

• Virtual reality lab provides 6 DOF training 

• One time use only 

• Evaluate SAFER reach in NBL 
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• The purpose of this overview is to inform the reviewers of: 

- Components of EMU 

- Suit f itcheck process/optimal suit fit 


23 
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jjj| EMU - Fitcheck Process 


• Proper f itcheck is critical! 

- ensures no long/short term physical impairments 

- ensures mission success 


• Iterative process utilizing predicted sizing for initial fit and 
crewmember comments for recommended sizing 

• Suit fit is evaluated in a 1 -G fitcheck prior to an NBL qual 
evaluation 

• After all suited events, post test summaries are distributed with 
suit fit comments 



Crew 
Suit Eng 




£> Fitchecks & Training Events 
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Fitcheck Process Flowchart 
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EMU Phase VI Gloves - Glove Fitcheck Process 



Glove Fitcheck Process Flow Chart 



• Iterative Process 
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EMU - Post Fitcheck 


* Evaluation suit fit during NBL and 1 -G events 

* Post Test Summaries document sizing issues 

* Class I hardware evaluated in chamber runs, FFV 

* 1" is added to the waist length for zero 6 spinal growth 
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ADDITIONAL US SPACECUIT PICTURES 


http://spaceflight.nas3.gov/gallerv/images/station/crew-32/html/iss032e024373.html 



ISS032-E-024373 (30 Aug. 2012) — NASA astronaut Sunita Williams, Expedition 32 
flight engineer, attired in an Extravehicular Mobility Unit (EMU) spacesuit, is pictured 
in the Quest airlock of the International Space Station prior to a session of 
extravehicular activity (EVA). 
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ISS036-E-014724 (3 July 2013) — NASA astronaut Chris Cassidy (left) and European 
Space Agency astronaut Luca Parmitano, both Expedition 36 flight engineers, attired 
in their Extravehicular Mobility Unit (EMU) spacesuits, participate in a "dry run" in 
the International Space Station's Quest airlock in preparation for the first of two 
sessions of extravehicular (EVA) scheduled for July 9 and July 16. NASA astronaut 
Karen Nyberg, flight engineer, assists Cassidy and Parmitano. 

http://spaceflight.nasa.gov/gallerv/images/station/crew-36/html/iss036e014724.html 
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How NASA Spacesuits Work: EMUs Explained (Infographic) 
http://www.space.com/21987-how-nasa-spacesuits-work-infographic.html 


DRESSED FOR SPACE 

The Extravehicular Mobility Unit (EMU) allows an astronaut to work outside a spacecraft for up to 7 
hours. Russian and Chinese space agencies use different types of suits. The EMU was manufactured 
by International Latex Corporation (ILC), with a life support system made by Hamilton Standard. 



* “snoopy 
cap" holds 

microphones 
tnd head- 
phones. 


A lull-body 

liquid- 
cooling 
garment has 

tubes carrying 
cool water to 
remove heal 
from the 
astronaut's 
skin. 


Under the 
cooling 
garment, the 


maximum 
absorbency 
garment, or 

adult diaper, to 
contain wastes. 


MIX AND MATCH 

The EMU is a system ol 
variously sued parts that can 
be combined to sue the suit 
lor any astronaut. 



LAYERS OF 
PROTECTION 

Thespacesuit has 14 
layers between the 
astronaut's skin and 
the vacuum ol space. 
The layers are In three 
assemblies: the liquid 
cooling garment to 
keep the astronaut 
from overheating, the 

pressure garment 

to retain air pressure 
within the suit and the 
thermal 
mkrometeoroid 
garmet to reflect the 
sun's heat and stop 
small bits of flying 
space debns 
( nncrometeoroldsl . 



7-13: THERMAL 

MICROMETEOROtD 

GARMENT 

INSULATION LAVERS 
(ALUMINIZED MYLAR) 


14: THERMAL 
MICROMETEOROID 
GARMENT 
COVER (ORTHO- 
FABRIC) 


4: PRESSURE GARMENT 
BLAODER (URETHANE 
COAT EO NYLON) 


& THERMAL MICROME TEOROID 
GARMENT LINER (NEOPRENE 
COATED R1PST0P NYLON) 

S: RESTRAINT LAYER 
(DACRON) 


1: LIQUID COOLING GARMENT LINER 
(NYLON TRICOT) 


2: LIQUID COOLING 


3: LIQUID COOLING 
GARMENT WATER 




The pants have a ring at 
the waist with bearings 
to help the astronaut 
turn his or her body. 

Red or 'candy cane' 
stripes on the suit help 
to tell astronauts apart 
in space. 


DISPLAY AND CONTROL MODULE 

Switches on the pack allow the astroraut to control oxygen, cooling, radio and 
other systems. Labels on the front ol the pack are written in reverse, so that 
the astronaut can read them using a wrist-mounted mirror. 


FEEDWATER 
VALVE SWITCH 




HEADGEAR: HELMETS AND VISORS 

The helmet (left) is a clear plastic 
bubble that contains pressurised 
oxygen for the astronaut to breathe. 

The air is circulated through the life 
support backpack to remove harmful 
carbon dioxide. 

The visor assembly i right) fits over 
the helmet and provides cameras, 
spotlights and a gold-tinted sun visor 
lo protect the astronaut's vision, as 
well as cameras and spotlights. 

SOU acts NASA, INURNAIIONAl UtEX COWOSATIOU (ILC) OOWB. MAWLTOW STAWOARO KARL TATE / © SPACE.COm 
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Appendix F. FDIR Reference Emails 
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Hernandez-Pelle, Amri I. (GSFC-5630) 


From: Scudder, Matthew P <matthew.p. scudder@boeing.com> 

Sent: Monday, August 05, 2013 7:04 PM 

To: Hernandez Pelle, Amri I. (GSFC 5630); Iannello, Christopher J. (Chris) (KSC 004); 

Galvez, Ronald M. (JSC EP511) 

Subject: RE: ISS PCU Failure Array Shunt FDIR Algorithm 

Attachments: US_EVA_22.docx 


All 8 power channels are independent so if even 1 array is shunted, that channel will be operating from batteries. ISS 
going to battery power is acceptable, as long as it is a relatively short duration. Operator initiated shutdown of ISS loads 
(referred to as power-downs) may occur if deemed warranted to lengthen the time the batteries can provide power to 
critical systems. 

Below is an example of a recent set of EVAs where the "space weather” forecast was favorable, such that upon PCU 
failure no additional safing action is required. 

There are no constraints (aside from EVA safety) when to unshunt the solar arrays. Commanded unshunting of the solar 
arrays may occur during insolation or eclipse, with the array pointing at any combination of SARJ and BGA positioning, at 
any point in the orbit. 

Matthew 


CONTROL NUMBER: 

011386 

SUBJECT: 

Request for VIPER Short-Term Plasma 
Forecast for US EVA 22 (36-1) 

REQUEST ORG: 

MOD 

STATE: 

DISPOSITIONED 

ACTIVITY: 

Increment 36 

GMT CREATED: 

2013/156:00:05 

GMT ACTION REQD: 

2013/189:00:00 

RESPONSE ORGs: 

IMC, ISSMER 


MOD REQUEST 

contact: Barrett, Elizabeth A. (SPARTAN), 45301 

SPARTAN requests VIPER provide short-term plasma environment forecast analysis to relieve array shunting 
constraints for US EVA 22 being planned for July 9th (GMT 1 90) in the event of a PCU failure and during the 
planned timeframe when one PCU will he powered down (Reference Flight Rule 139-908 paragraph 
D). SPARTAN requests that the UV2B array combination remain unshunted following PCU failure during the 
EVA. Beyond that, the arrays which SPARTAN would prefer to be cleared, in preferred order, are IB, 2A» 4A, 
4B, 3B, 3 A. SPARTAN understands that not all will likely be allowed, but the full set of preferred order is 
provided for completeness. 

It is understood that the application of the short-term plasma environment forecast process for a pre-planned 
EVA represents a change to the process in Hazard Report ISS-EVA-0312 and NCR-ISS-232F,. The safety 
community (via the safely console) is requested to concur with this application of the short-term plasma 
environment forecast. 

In the event the plasma forecast indicates that no arrays need to be shunted, SPARTAN requests that PCU FDIR 
be left inhibited during the entire EVA. In this situation, enabled software would shunt the arrays but then they 
would be manually unshunted based on the plasma forecast. Having the software enabled would create 
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additional, unnecessary actions. It is understood that not enabling the PCU FDIR represents a change to the 
process in Hazard Report ISS-EVA-0312 and NCR-ISS-232E. The safety community (via the safety console), 
ISS MER and IMC is requested to concur with not enabling the PCU EDIR for the entire EVA if the short term 
plasma forecast predicts that no arrays need to be shunted or wake pointed after a PCU failure. Note that the 
FDIR will be inhibited when one PCU is powered down for sating as pail of the nominal EVA timeline (the 
arrays will be appropriately safed during this timeframe). 

It is understood that FPMU data will be required to produce this short-range forecast. Note that this EVA will 
take place in a +XVV altitude. 

'lTie preliminary forecast is needed 2 weeks prior to the start of the EVA so that the Flight Control Team can 
plan for the expected BOA feathering requirements and impacts in support of the planned PCU deactivation 
during the EVA. It is understood that the 2 week forecast is not final and is subject to change. The Flight 
Control Team will work to the forecast provided but also carry' a separate worst-case plan as well. 

The final forecast is needed at least 24 hours prior to the start of the EV A so that the Flight Control Team can 
uplink a revised version of Warning procedure 2.646 PCU 3B(4B) EVA Hazard to the Crew and finalize BOA 
feathering and powerdown plans. 

Actions: 

VIPER: Provide short-term plasma forecast 
ISS-MER, IMC: Provide concurrence 


IMC RESPONSE 

contact: Cranford, Cindy (Manager), 46161 

IMC has reviewed and concurs with the information in this chit. 

ISSMER RESPONSE 

contact: Palacios, George J. (Manager), X39456 
EVA 

contact: Thomas, Lawrence A. (EVA), 281-483-9163 
EVA Concurs 

SAFETY 

contact: Daniel, Christina D. (SAFETY), 281-335-2183 
Safety concurs with this chit. 

VI 
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contact: ROMILLO, JESSICA L. (VIPER), 281-226-4428 

FPMU eclipse exit Ne and Te data from June 17-24 have been compared to calculations using the IRI-201 1 
model. The results show that the ionosphere is currently in a nominal to 2s state. In order to be conservative, 
this assessment is based on a nominal environment. 

Based on the solar array plan provided by VIPER, and the present ISS nominal plasma environment determined 
by tire FPMU data, no solar arrays woidd need to be shunted/wake pointed in the event of a PCU failure. 

Note: The Space Environments team will continue to monitor the Sun-F.arth environment parameters, 
FPMU data, and Vehicle operations (e.g. Reboost/DAM) to determine if the forecast continues to be 
applicable. If the current ionospheric variability changes from the value shown in this analysis or an 
unplanned operation that changes the vehicle velocity occurs, there may be additional constraints. The 
Space Environments team w ill notify the VIPER console as soon as possible, if that occurs. 

Attachment: US_EVA_22.docx 
Attachments 


US_EVA_22.docx (41 KB) 




MOD DISPOSITION 



contact: Barrett, Elizabeth A. (SPARTAN), 45301 


SPARTAN acknowledges. Based on the forecast, both PCUs will be in discharge but the PCU FDIR will not 
be enabled and BGAs will not be preemptively parked for the planned powerdown of PCU 2 due to the Y- 
jumper installation sating. However, the timeline will maintain these callouts (which can be aborted if not 
required) to protect for the possibility of a change in the forecast prior to execution. 

This CHIT should remain in disposition until afler US EVA 22. (ECD GMT 191) 

US EVA 22 was completed nominally with all BGAs remaining in autotrack for the PCU down 
timeframe, 'litis CHIT can be closed. 


From: Hernandez-Pelle, Amri I. (GSFC-5630) [mailto:amri.i.hernandez-pelle@nasa.gov] 
Sent: Wednesday, July 31, 2013 7:23 PM 

To: Scudder, Matthew P; Iannello, Christopher J. {Chris) (KSC-C104); EXT-Galvez, Ronald M 
Subject: RE: ISS PCU Failure Array Shunt FDIR Algorithm 


Hi Matthew, 

I have two more topics related to the FDIR array shunting to ask you about: 
1) The B9-908 document states: 
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The one failure deep cose that removes power to both a PCUand a prlmory PVCU is the rationale for setting all eight arrays to shunt in the PCU FDIR versus 
only six arrays. This ensures that even if a PVCU failure does not allow shunting of an array pair, the necessary number of arrays are still shunted. No PVCU 
transition is necessary if the array pair controlled by a PVCU that shares a power channel with a PCU is allowed per paragraph D (or E if HTV is berthed). 

Are all eight arrays always shunted upon a PCU failure? If yes, does that mean the ISS going to battery 
power is acceptable? 

2) Last time you explained us (supported by the document) that arrays are unshunted only if placed >15 degrees to 
wake. However, are there any rules or specifications of when can the un-shunting commands occur relative to 
in-sunlight, in-eclipse, time within sunlight, etc...? Or is it when needed regardless of time in orbit? Any other 
(non-time, nor > 105°) related restrictions to un-shunt? 

Once again thank you for your support, 

Amri 
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Hernandez-Pelle, Amri I. (GSFC-5630) 


From: Scudder, Matthew P <matthew.p.scudder@boeing.com> 

Sent: Wednesday, July 17, 2013 6:21 PM 

To: Hernandez Pelle, Amri I. (GSFC 5630); Iannello, Christopher J. (Chris) (KSC 004); 

Galvez, Ronald M. (JSC EP511) 

Subject: RE: ISS PCU Failure Array Shunt FDIR Algorithm 


Is the FDIR in charge of pointing the arrays to > 105° from the velocity vector?, Or a separate control (or software) does 
that? 

The ground (MCCH) will command the solar arrays to their new positions, once the PCU failure is confirmed. 

Does the FDIR prevents other controls from unshunting the arrays while it is enabled or can it be overwritten during 
operation by an external control? 

Once the arrays are shunted (software will retry up to 3 times, with 15 seconds between tries) the software doesn't do 
anything else. Once the arrays are shunted via the FDIR, if an operator were to command a SSU to unshunt the arrays, it 
will go thru. 

I am trying to understand where is the operational priority for the array >105 pointing and unshunting and how the FDIR 
fits in the commands/controls priority or hierarchy. 

The primary controls for the EVA Hazard are the two PCUs. Since it's a catastrophic hazard, a third control is 
required. Since the hazard has been determined to only exist when the solar arrays are unshunted (providing power) 
and pointed towards the velocity vector (in the ram direction), the third control can be to either shunt the arrays (the 
FDIR) or to ensure the arrays are out of the velocity vector. Keeping the arrays out of the velocity vector leads to poor 
power generation thru the majority of the orbit, and to maintain power balance, the powerdowns required for the 
entire duration of the EVA would be severe. The program does not like the idea of the severe powerdowns unless 
absolutely necessary (loss of science, excessive MCCH workload, risk to single string systems, etc) therefore over the 
years we have made it the "backup" plan. (I’m referring mostly to paragraphs A and B in the flight rule below.) 


Matthew Scudder 

Boeing ISS EPS Engineering, Hardware Lead 
281-226-6975 


The following is Flight Rule B9-908: 

B9-908 PLASMA HAZARD MITIGATION DURING EVA [HC] [RC] 

A. DURING NOMINAL EVA PERIODS, HAZARD CONTROLS ARE REQUIRED AS 
FOLLOWS: ®[022802-5153B] ®{08181 1-00363B] 


1. TWO PCU'S ACTIVE IN DISCHARGE MODE 

2. ONE OF THE FOLLOWING: 

a. CCS PCU EVA HAZARD CONTROL FDIR ENABLED 

b. NO MORE THAN 2 ARRAYS UNSHUNTED WHILE ORIENTED LESS THAN 105 
DEGREES FROM THE VELOCITY VECTOR. ALLOWED 2 ARRAY 
COMBINATIONS ARE DOCUMENTED IN PARAGRAPH D (OR E IF HTV 
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BERTHED) . ANY ARRAY ORIENTED 105 DEGREES OR GREATER FROM THE 
VELOCITY VECTOR MAY BE UNSHUNTED. 

B. IN THE EVENT OF PCU FAILURE DURING OR PRIOR TO AN EVA, CCS PCU EVA 
HAZARD CONTROL, IF ENABLED, WILL SHUNT ALL ACTIVE SOLAR ARRAYS. THE 
EVA MAY CONTINUE WITH ONE OR ZERO ACTIVE PCU'S AFTER THE FOLLOWING 
CONFIGURATION HAS BEEN ESTABLISHED: 

NO MORE THAN 2 ARRAYS UNSHUNTED WHILE ORIENTED LESS THAN 105 DEGREES 
FROM THE VELOCITY VECTOR. ALLOWED 2 ARRAY COMBINATIONS ARE DOCUMENTED 
IN PARAGRAPH D (OR E IF HTV BERTHED). ANY ARRAY ORIENTED 105 DEGREES 
OR GREATER FROM THE VELOCITY VECTOR MAY BE UNSHUNTED. 

C. IF METHOD OUTLINED IN PARAGRAPH B DOES NOT ACHIEVE SATISFACTORY 
PREDICTED BATTERY SOC, THEN SOLAR ARRAY POSITIONING WILL BE GUIDED BY 
RULE { B2-38 } , SOLAR ARRAY POSITIONING PRIORITIES. ©[081811-00363BJ 

This Rule Continued on Next Page 
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B9-908 plasma hazard mitigation DURING EVA [he] [RC] (continued) 

D. THE FOLLOWING ARRAY COMBINATIONS MAY REMAIN UNSHUNTED AND/ OR POINTED 
IN THE VELOCITY VECTOR FOLLOWING A PCU FAILURE IF HTV IS NOT BERTHED 
TO ISS (TO INCLUDE ATV BUT EXCLUSIVE TO COTS VEHICLES): <8(081811-003638] 


POWER 

CHANNELS 

STATION 

ATTITUDE 

INBOARD 
OF PORT 
SARJ 

INBOARD 
OF STBD 
SARJ 

OUTBOARD 
OF PORT 
SARJ 

OUTBOARD 
OF STBD 
SARJ 

CENTERLINE 
OF VEHICLE 

1A.2B 

+XW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

(PREFERRED) 

-xw 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


+YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

1A. 2A 

+XW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-XW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


+YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

2B. 3A 

+XW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-xw 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


+YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

SG 

+XW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

1B.3B 

-XW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


+YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

S4 

+XW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

1A. 3A 

-xw 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


+YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

P4 

+XW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

2A. 4A 

-xw 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


+YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

P6 

+XW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

2B.4B 

-XW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


+YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

OTHER 

COMBINATIONS 

ANALYZED 

NOT 

ANALYZED 

NOT 

ANALYZED 

ANALYZED 

ANALYZED 



®(0621 12-00554 ] 


Column labeled as “Centerline of Vehicle " is applicable for EVA crew on the modules along the centerline of the vehicle 
(PMA2, Node2, U.S. Lab, Nodel, PMM, 21, PMAl, FOB, SM, DC-1, MKMl, MRM2, MLM). 

Columns labeled as Inboard of Port or Stbd til 111 refer to EVA crew located on the truss inboard of the respective 
SARJ. It also includes EVA crew on modules that are not on the centerline of the vehicle (Columbus, JEM, JEM-EF, 
JEM -ELM, Airlock, Cupola, Node}). 

Following a loss of both PCU’s, the maximum allowed negative voltage is -45.5 V. If array shunting or offpointing is 
maintained per this table, a second PCU failure will not result in a hazardous voltage. €(08181 1-00363B] 

This Rule Continued on Next Page 
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B9-908 plasma hazard mitigation DURING EVA [he] [RC] (continued) 

E. DURING EVA'S WITH HTV ATTACHED, THE FOLLOWING PLASMA HAZARD MITIGATION 
REQUIREMENTS APPLY AND SUPERSEDE PARAGRAPH D: «|081811-00363B] 


POWER 

CHANNELS 

STATION 

ATTITUDE 

INBOARD OF 
PORT SARJ 

INBOARD 
STBD SARJ 

OUTBOARD 
OF PORT 
SARJ 

OUTBOARD 
OF STBD 
SARJ 

CENTERLINE 
OF VEHICLE 

1 A, 2B 

♦xw 

NOT ALLOWED 

NOT 

NOT 

NOT 

ALLOWED 

(PREFERRED) 



ALLOWED 

ALLOWED 

ALLOWED 



-xw 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


+YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

1 A, 2A 

♦XW 

NOT ALLOWED 

NOT 

NOT 

NOT 

ALLOWED 




ALLOWED 

ALLOWED 

ALLOWED 



-xw 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


+YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

2B, 3A 

♦XW 

NOT ALLOWED 

NOT 

NOT 

NOT 

ALLOWED 




ALLOWED 

ALLOWED 

ALLOWED 



-xw 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


+YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

S6 

♦XW 

NOT ALLOWED 

ALLOWED 

NOT 

NOT 

NOT 

IB, 3B 




ALLOWED 

ALLOWED 

ALLOWED 


-xw 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


+YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

S4 

♦XW 

NOT ALLOWED 

ALLOWED 

NOT 

NOT 

ALLOWED 

1 A, 3A 




ALLOWED 

ALLOWED 



-xw 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


♦ YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

P4 

♦xw 

ALLOWED 

NOT 

NOT 

NOT 

ALLOWED 

2A, 4A 



ALLOWED 

ALLOWED 

ALLOWED 



-XW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


♦YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

P6 

♦ XW 

ALLOWED 

NOT 

NOT 

NOT 

ALLOWED 

2B, 4B 



ALLOWED 

ALLOWED 

ALLOWED 



-XW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


♦YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 


-YW 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

ALLOWED 

OTHER 

NOT 

NOT 

NOT 

NOT 

NOT 

NOT 

COMBINATIONS 

ANALYZED 

ANALYZED 

ANALYZED 

ANALYZED 

ANALYZED 

ANALYZED 


S t081 811 -00363 B] ®[0621 12-00554 ] 


This Rule Continued on Next Page 
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B9-908 plasma hazard mitigation DURING EVA [he] [RC] (continued) 

Column labeled as “ Centerline of Vehicle " is applicable for EVA crew on the modules along the centerline of the vehicle 
(PMA2, Node2, U.S. Lab, Node 1, PMM, Zl, PMA1, FOB, SM, DC-1, MRMI, MRM2, MIM). < 8 ( 08181 1-00363B] 

Columns labeled as Inboard of Port or StbdSARl refer to EVA crew located on the truss inboard of the respective 
SARJ. It also includes EVA crew on modules that are not on the centerline of the vehicle (Columbus, JEM. JEM-EF, 
JEM-ELM, Airlock, Cupola, Node3). 

For most EVA 's +XW with MTV mated, if a PC.U fails, the shunt FDIR is insufficient to control the negative floating 
potential voltage to comply with the -45 volt limit. With HTV docked, for EVA 's. the ISS may be configured to fly -XVV or 
±YVV to achieve a more optimal array configuration. 

Following a loss of both PCU’s, the maximum allowed negative voltage is -45.5V. If array shunting or off pointing is 
maintained per this table, a second PC U failure will not result in a hazardous voltage. 

F. PARAGRAPHS A THROUGH E DEFINE THE GENERIC PCU HAZARD PROTECTION AND 

FAILURE SAFING GUIDELINES FOR ANY EVA. IN REAL TIME, THE ENVIRONMENTS 
MER MAY BE ABLE TO USE RECENT PLASMA DATA FROM THE FPMU AND OTHER 
SOURCES TO MORE SPECIFICALLY CHARACTERIZE THE EXPECTED ON-ORBIT PLASMA 
ENVIRONMENT AT THE TIME OF A PLANNED NOMINAL OR CONTINGENCY EVA. IF 
THIS INFORMATION RESULTS IN DIFFERENT REQUIREMENTS THAN THOSE LISTED 
IN PARAGRAPHS A THROUGH E, A CHIT WILL BE WRITTEN TO TEMPORARILY 
SUPERSEDE THE APPROPRIATE PORTIONS OF THIS RULE. <8(0621 12-00554) 

The plasma hazard short term forecasting process that utilizes data from the Floating Potential Measurement Unit 
(FPMU) to adjust constraint real-time relief has been approved by the August 9, 2011 SRP and is documented in Hazard 
Report ISS-EVA-031 2 and the safety non-compliance report NCR-ISS-232. If while planning for a contingency or 
nominal EVA during mission or stage, real-time data shines that the plasma environment does not require as stringent a 
configuration for hazard control as this rule provides, MER can provide updated hazard control requirements via the 
CHIT process. Any event which would invalidate the short term forecast would result in the implementation of the 
appropriate requirements per paragraphs A-E. <8(08181 1-00363B] 

This Rule Continued on Next Page 
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B9-908 plasma hazard mitigation DURING EVA [he] [RC] (continued) 

G. IF A PVCU AND PCU SHARE THE SAME POWER CHANNEL, IT MUST BE ASSUMED 

THAT CCS PCU EVA HAZARD CONTROL FDIR WILL NOT AUTOMATICALLY SHUNT THE 
TWO POWER CHANNELS CONTROLLED BY THAT PVCU. IF THE RESULTING 
CONFIGURATION IS 'NOT ALLOWED' OR 'NOT ANALYZED' PER PARAGRAPH D (OR E 
OF HTV IS BERTHED), A PVCU TRANSITION WILL BE PERFORMED PRIOR TO THE 
EVA. ®[081 81 1 -00363B] 

The one failure deep case that removes poster to both a PCU and a primary PVCU is the rationale for setting all eight 
arrays to shunt in the PCU FDIR versus only six arrays. This ensures that even if a PVCU failure does not allow 
shunting of an array pair, the necessary number of arrays are still shunted. No P VCU transition is necessary if the array 
pair controlled by a PVCU that shares a power channel with a PC U is allowed per paragraph D (or E if HTV is berthed). 

Three hazard controls are required during EVA activities if floating potential magnitudes exceed -40V. If both PCU’s are 
available and functional, then one additional control is required. CCS PCU EVA Hazard Control provides the third 
control for the nominal case. In the event of PCU failure or shutdown, the CCS PCU EVA Hazard Control detects the 
loss and immediately shunts all solar arrays, maintaining plasma protection until further action is taken. NCR-ISS-232 
documents acceptance of voltages up to -45.5V in cases where a PCU failure results in a voltage higher than 
requirements. This NCR allows greater flexibility and allows particular sets of two solar array’s to remain unshunted 
and/or tracking, if analysis shows that the worst case voltage is within the expanded -45.5V limit. 

Per the CCS PCU EVA Hazard Control as documented in the CCS SRS Paragraph 3. 2. 3.2. 9, in the event of a PCU 
failure. ha\>ing all solar arrays shunted provides the required controls until the ground takes additional action. Specific 
analysis has been performed to document two-array pairs that can be unshunted without risk of a -45.5V limit 
violation. Once all arrays are shunted, the operator has the option of unshunting two active solar arrays from the table in 
paragraph E. and placing any additional arrays 15 degrees or more to wake. 15 degrees has been chosen to account for 
the maximum expected attitude deviation. As long as no more than two unshunted arrays from the table are facing ram at 
any one time, no -45.5V violation exists and the hazard is property controlled. ®(081811-00363B] 

This Rule Continued on Next Page 
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B9-908 plasma hazard mitigation DURING EVA [he] [RC] (continued) 

Hazard Report ISS-EVA-312 identifies a catastrophic shock hazard to EVA crewmembers due to vehicle arcing through 
the EMU suit. Electrical currents generated by vehicle arcing may pass through an EMU suit and crewmember when the 
vehicle floating potential is more negative than -40V. ®[081811-00363B] 

Fully retracted solar arrays do not require any plasma hazard control actions. 

Reference Hazard Report ISS-EVA-31 2, Electric Shock to EVA Crew Resulting from EMU Arcing to Plasma, ISS 
Environments Memorandum EID684-1 2386 Worst-Case Plasma Charging Analysis for 15A and Beyond, NCR ISS-232 
Lack of Two-Fault Tolerance to EVA Crew Shock in the Low Earth Orbit Plasma Environment, and E1D684-1 3598. 
Worst-Case Plasma Charging Analysis for 17A. <©(0621 12-00554 | 

For additional reference in pointing the U.S. Solar Arrays, refer to procedure EPS 5. 103 for the U.S. Solar Array pointing 
convention. «(081811-00363B) 

FLIGinVSTAGE EFFECT! VITY: ALL FLIGHTS 


From: Hernandez-Pelle, Amri I. (GSFC-5630) [mailto:amri.i.hernandez-pelle@nasa.gov] 

Sent: Wednesday, July 17, 2013 4:21 PM 

To: Scudder, Matthew P; Iannello, Christopher J. {Chris} (KSC-C104); EXT-Galvez, Ronald M 
Subject: RE: ISS PCU Failure Array Shunt FDIR Algorithm 

Hi, 

Thanks for the response Matthew. I need some clarifications too: 

Is the FDIR in charge of pointing the arrays to > 105° from the velocity vector?, Ora separate control (or software) does 
that? 

Does the FDIR prevents other controls from unshunting the arrays while it is enabled or can it be overwritten during 
operation by an external control? I am trying to understand where is the operational priority for the array >105 pointing 
and unshunting and how the FDIR fits in the commands/controls priority or hierarchy. 

Thanks 

Amri 


From: Scudder, Matthew P f mailto:matthew.p.scudderiaiboeina.coml 
Sent: Wednesday, July 17, 2013 2:42 PM 

To: Iannello, Christopher J. {Chris} (KSC-C104); Galvez, Ronald M. (JSC-EP511); Hernandez-Pelle, Amri I. (GSFC-5630) 
Subject: RE: ISS PCU Failure Array Shunt FDIR Algorithm 

In order to maintain ISS power balance, we'll want to unshunt arrays when allowed. So given your scenario, once the 
arrays are shunted and the PCU verified failed (shunting wasn't due to a false trigger) the arrays will be pointed > 105° 
from the velocity vector, then we'd unshunt the arrays. 

Matthew 
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From: Iannello, Christopher J. {Chris} (K9C-C104) f ma i It n : rh ristonh er . i. ian ne I h @nasa . ij ov 1 

Sent: Wednesday, July 17, 2013 11:49 AM 

To: EXT-Galvez, Ronald M; Hemandez-Pelle, Amri I. (GSFC-5630) 

Cc: Sc udder, Matthew P 

Subject: RE : ISS PCU Failure Array Shunt FDIR Algorith m 

Guys 

Thanksforthis. 

Just one clarification 1 am unclear on. 

Is there a circumstance that: after a PCU failure and we’ve shunted XX arrays crew are on EVA, that we'd unshunt any 
arrays? 

Sounds like no below but want to make sure. 



Chus i A 

Chris Iannello, Ph D. 

NASA Technical Fellow for Electrical Power 
NASA Engineering and Safety Center 
Kennedy Space Center. Florida. 32899 
Cell: 407-252-8448 


http:y7www-nasa.gov/offices/nesc7teamyChris Iannello bio.html 


From: Galvez, Ronald M. (J9C-EP511) 

Sent: Friday, July 12, 2013 5:59 PM 

To: Iannello, Christopher J. {Chris} (K9C-C104); Flernandez-Pelle, Amri I. (GEFC-5630) 
Cc: 9CUDDER, MATTHEW P. (J9C-OB6)[THE BOEING COMPANY] 

Subject: FW: ISS PCU Failure Array Shunt FDIR Algorithm 

Chris, 

Below answers courtesy of Matt Scudder, the Boeing EPS Hardware focal. 

Ron 


From: <SCUDDER>, Matthew Scudder < tnatthew.o. scudder@bo ring. com > 

Date: Friday, July 12, 2013 4:53 PM 

To: Ronald Galvez < Ronald.mgalvez@nasagov >- Casey Adams < casev ,i. adams@boeing.com > "SHAH, DHARMESH 
D. (JSC-OB)[THE BOEING COMPANY]" < dharmesh.d.sfaah@boeing.com >. "Kaminski, R^mond (JSC- 
OA)[BOEING]" < raymo nd. i . kaminski @b o ein g. com > 

Cc: Rustin Robetorye < rustin. c. rob eto rv e@b o eing . c om> 

Subject: RE: ISS PCU Failure Array Shunt FDIR Algo nthm 


Ron, Sorry didn't see email until now. I'm assuming you’ll passthisonto Chris. Thanks! 

1. question i s what happ ens to the S SU when the PC U fail s - do one or more array shunt? 
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Upon detection of a PCU "failure", the CCS will issue commands to shunt up to 8 SAWs via their SSUs. "Up to 8" is pre- 
defined by MCC-H via a "weather forecast". In other words, if the "space weather" is relatively benign, and 3 active 
arrays result do not result in a hazardous condition with no PCUs, MCCH can set the FDIR to shunt 5 solar arrays. 

2. When do we enable PCU (I believe this may be environments related) 

PCUs are only enabled to discharge during EVAs, both Russian and US. 

3. Recovery' plan appears to be an operations call, but, not sure 

Two main recovery paths are possible. 1) (Nominal response) Maintain XX (See "space weather" above) Solar Arrays a 
minimum of 105" out of the velocity vector. When a SAW is > 105" from the velocity vector, it is deemed not a 
contributor to the EVA Hazard, and thus may be unshunted. This requires placing both the SARJ and BGAs into directed 
position to ensure the >105° requirement (and no LOAC). 2) Terminate EVA. Once the crewmembers are inside the 
Airlock, and the door shut, the Solar Array Wings may be unshunted. 

4. Could crew be on EVA? Not sure when you have the PCU active without a crew. 

The only time PCUs are placed into discharge now is during EVAs 

0. Specifically, how is it enabled and when? 

In preparation for an EVA, several hours before the crew is scheduled to go out the door, the PCUs are commanded from 
Standby Mode to Discharge Mode. After verifying the two PCUs are operating nominally, commands are issued to the 
C&C MDM to enable the EVA Hazard Control Function (aka PCU Failure Array Shunt FDIR Algorithm). At the conclusion 
of the EVA, MCCH issues commands to disable the EVA Hazard Control Function before the PCUs are returned to 
Standby Mode. 

Matthew 

From: EXT-Galvez, Ronald M 
Sent: Friday, July 12, 2013 3:46 PM 

To: Adams, Casey J; Shah, Dharmesh D; Scudder, Matthew P; Kaminski, Raymond J 
Cc: Robetorye, Rustin C 

Subject: Re: ISS PCU Failure Array Shunt FDIR Algorithm 

Have you guys had a chance to look at this? Kinda hard when you are on travel. Can you look at this early next week? 

Thanks 

Ron 


From: <Galvez>, Ronald Galvez <Ronald.m.galvez@,nasa.gov> 

Date: Wednesday, July 3, 2013 12:26 PM 

To: Casey Adams < ca.scv.i adams@bocing.com >. "SHAH, DHARMESH D. (JSC-OB)[THF. BOEING COMPANY]" 
< dharmcsh.d.shah fl hocing.com -. Matthew Scuddcr <matthcw.n.scuddcr@bocing.com> . "Kaminski, Raymond (JSC- 
OA)[BOElNG]" < ravmond.i.kaminski@boeing.com> 

Cc: Rustin Robetorye <rustin.c.robetorve@boeing.com> 

Subject: FW: ISS PCU Failure Array Shunt FDIR Algorithm 

Casey/Dharmesh/Matt/Ray 

Hate to dump but, the FDIR is something that may be in your neck of the woods. Can you point me in the right direction? 
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1. question is what happens to the SSU when the PC U foils - do one or more array shunt? 

2. When do we enable PCU (I believe this maybe environments related) 

3. Re covery plan appearstobeanop erati ons call , but, not sure 

4. Could crewbe on EVA? Hot sure when you have the PCU active without a crew. 

Thanks 

Ron 


From: <Iannello>, "Christopher J. {Chris) (KSC-C104)" < din st onh er. i .1 arm ell o @nas a gov > 

Date Wednesday, July 3, 2013 12:04 PM 

To: Ronald Galvez < Ronaldm.galvez@nasagov > 

Subject: ISS PCU Failure Array Shunt FDIR Algorithm 

Ron, 

Areyou knowledgeable on how the FDIR works? We are relooking at the necessity of PCU sat JSC’s (koontz’s) request. 
Specifically, how is it enabled and when? 

If a PCU fails when FDIR is enabled, do all array’s get shunted or just some? 

What is recovery plan to unshunt an array? Could crew be on EVA when that happens? 

Thanks Ron...Chris 



Chus T CU W A 

Chris lannello, Ph D. 

NASA Technical Fellow for Electrical Power 
NASA Engineering and Safety Center 
Kennedy Space Center. Florida. 32899 
Cell: 407-252-8448 


htta://www.nasa.gov/offices/nescAeam/Chris lannello bio.html 
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Appendix G. Maximum Magnetic Induction Potential Along ISS 

Truss 

Inductive potential differences exist between two points on the ISS metallic structure due to 
motion of the vehicle across the Earth’s magnetic field. The magnitude of the potential 

difference Sauced between two points separated by a distance L is given by the vector equation 

^induced — (v X B) *L (1) 

where v is the ISS velocity and B the Earth’s magnetic field strength at the location of ISS. 
Values of Seduced are small near the equator where the dominant component of the Earth’s 
magnetic field vector lies along the direction of the ISS truss (in the typical +/-XVV flight 
attitude) and the dot-product between v x B and the vector components of L along the Truss is 
small. The extremes in potential difference between the ends of the ISS truss due to magnetic 
induction will occur at high latitudes where geomagnetic field lines are steeply inclined relative 
to the Earth’s surface (and the ISS truss in typical flight attitudes), maximizing the v x B 
components along the length of the truss. In this case, the vector equation can be reduced to the 
scalar form 


^induced vB,L[ (2) 

where the ISS velocity v is assumed to be parallel to the Earth’s surface, B r is the radial 
component of the Earth’s magnetic field, and L T is the length of the ISS Truss. 


The ISS coordinates of the Truss tips are (D. Schmidl, personal communication, 2013): 
Starboard Truss Tip X = +0.73 meters 

Y = +47.15 meters 
Z = +0.73 meters 


Port Truss Tip X = +0.02 meters 

Y = -47.13 meters 
Z = +0.73 meters 

The distance between the Truss tips is L T = (+47.15 meters + 47.13 meters) = 94.28 meters along 
the y-axis. The small contribution from the different locations of starboard and port tips in the x- 
direction has been neglected for this analysis. 

Variation in ISS velocity as a function of altitude can be estimated from the equation for velocity 
of a circular orbit: 

v = Jfi/(z + R E ) (3) 

where p = 3.986xl0 14 m 3 /s 2 and z+R E is the geocentric radial distance of the circular orbit at 
altitude z above the mean Earth radius Re =6371 km. For example, ISS orbital velocity at an 
altitude of 400 km is 7673 m/s assuming the orbit is circular. 
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Magnetic field intensity also varies as a function of altitude with the field intensity decreasing 
with increasing altitude. Numerical B r magnetic field component values are conveniently 
obtained from NASA’s Community Coordinated Modeling Center’s implementation of the 
International Geomagnetic Reference Field (IGRF) model 
(http ://ccmc . gsfc .nasa. gov/modelweb/models/igrf vitmo .php) . 

The values used here are obtained from the IGRF model for the current year (2014) at latitudes 
of +5 1 .6 degree in the northern hemisphere and -51.6 degree in the southern hemisphere. 
Because the magnetic field intensity varies with longitude, the model was run as a function of 
longitude between 0 degree longitude and 360 degree longitude in 1 -degree increments to find 
the maximum value of the radial magnetic field component in order to estimate the worst case 
induction potential along the ISS orbit. 

Maximum IGRF B r magnetic field components in the northern and southern hemisphere and 
orbital velocity values from equation (3) as a function of altitude are listed in Table G-l along 
with the corresponding magnetic induction potential between the ISS Truss tips computed from 
equation (2). The distance 94.28 meters is used in all calculations. 


Table G-l. Maximum Induction Potential Between ISS Truss Tips 



ISS 

Velocity 

Northern 

Hemisphere 

Southern Hemisphere 

(m/s) 

Br (nT) 

^induced 

Br (nT) 

^induced 

330 

7713 

48046.1 

34.9 

55271.7 

40.2 

340 

7707 

47800.4 

34.7 

55002.5 

40.0 

350 

7701 

47556.3 

34.5 

54735.1 

39.7 

360 

7695 

47314.0 

34.3 

54469.4 

39.5 

370 

7690 

47073.3 

34.1 

54205.4 

39.3 

380 

7684 

46834.3 

33.9 

53943.2 

39.1 

390 

7678 

46596.9 

33.7 

53682.6 

38.9 

400 

7673 

46361.2 

33.5 

53423.8 

38.6 

410 

7667 

46127.0 

33.3 

53166.6 

38.4 

420 

7661 

45894.5 

33.1 

52911.1 

38.2 


Extreme inductive potential differences of approximately 40V between the tips of the ISS Truss 
may occur when the ISS orbital altitude is low. For example, ISS orbital altitudes were allowed 
to drop to approximately 335 km during 2001 and again in 2007. Mean ISS orbital altitudes in 
2014 have all exceeded 400 km with typical mean altitudes between 413 km and 418 km. A 
good estimate of the extreme inductive potential difference between the Truss tips for current 
ISS altitudes reported to the nearest volt is therefore 38V. 
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Appendix H. International Space Station Electrical Power Systems 
Training Manual ISS EPS TM 21109 (Section 2.3.4) 
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01.04.05(0)T0005 
Version 1 .0 
(supersedes TD9707) 


International Space Station 
Electrical Power Systems 
Training Manual 

ISS EPS TM 21109 



Mission Operations Directorate 
Space Flight Training Division 


August 26, 2004 




National Aeronautics and 
Space Administration 

Lyndon B. Johnson Space Center 
Houston, Texas 


Contract NAS9-20000 
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2.3. 3.4 Monitoring 

There is no telemetry specific to the UOP. 

2.3.3. 5 Replacement/Location 

The UOPs are located in the standoffs of the Node, Lab, and Airlock and can be 
changed out on orbit as needed. 

2.3.4 System/User Protection 

System protection encompasses the architecture’s ability to detect that a fault condition 
has occurred, confine the fault to prevent damaging connecting components, and 
execute an appropriate recovery process to restore functionality, if possible This 
process is usually referred to as FDIR For example, upon detection of a fault, 
components can be isolated, thereby preventing propagation of faults. In response to 
overcurrent conditions, the architecture is designed such that each downstream circuit 
protection device is set to a lower current rating and responds more quickly than the 
protection device directly upstream. This ensures that electrical faults or "shorts” in the 
system do not propagate toward the power source. The architecture's system- 
protection also shuts down power production when array output voltage drops below a 
specified lower-limit threshold. This prevents the PV ceils from operating in low-voltage, 
high-current applications, causing cell overheating. In summary, all the various 
implementations of system-protection work together to isolate faults or shorts at the 
lowest level. This approach minimizes impacts to the users of the EPS and also 
protects the EPS from complete failure from low-level faults. 

User protection encompasses the architecture's ability to protect the crew from electrical 
shocks. This is can be accomplished via grounding, specific hardware fault isolators 
(such as a Ground Fault Isolator (GFI) circuit), or through procedure or operational 
constraints. 

In addition to the fault detection and isolation capabilities of the secondary power 
system, several other specific functions provide further protection for both the electrical 
components and the crew: Load shed software, grounding, the Rack Power Switch 
(RPS), and the PCU. 

2.3.4. 1 Components 

Load shedding is a software process by which the C&C MDM automatically shuts down 
equipment to prevent channel overloading; this can also be initiated manually via the 
PCS. The grounding function is accomplished with the SPG architecture that maintains 
all components on the USOS are at a common potential. RPSs are used to remove 
power from an entire rack so that the crew will be protected during maintenance or 
installation activities. Finally, a PCU is used to minimize the difference in potential 
between the ISS and the surrounding space environment. 
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Load Shed Software 


Load shed can be commanded or initiated automatically by an overcurrent condition on 
a power channel (i.e. , high BCDU output or a low BCDU bus voltage). Except for 
system malfunctions, resource management should normally account for power 
demand on the power channel and prevent the need for load shedding. 

When the Tier II EPS MDM (PMCU MDM) detects a load shed condition on a power 
channel, an indication is sent to the C&C MDM The load shed function acts to reduce 
loads on that power channel by commanding RPCs open in approximately 500 W 
blocks. This function is based upon predetermined load shed tables that can be 
uploaded from the ground to the C&C MDM. For example, if 1 200 W needs to be shed 
to remove the load shed condition on power channel 2B, the C&C MDM will load shed 
3 blocks (assuming 500 W per block and thus potentially 1 500 W total). However, 
because not all components in the load shed table may be operating, 1500 W may not 
actually be shed. If the load shed condition persists, the process will be repeated, and 
load shed will be repeated, again removing loads in approximately 500 W blocks until 
the load shed condition no longer exists. 

Single Point Ground 

The primary purpose of the SPG design is to protect crew and equipment from power 
surges and unbalanced loads that can present an electrical shock hazard. Unbalanced 
loads can be avoided by tying neutral electrical lines to a conductive single point 
ground. In doing so, USOS loads will have the same reference point, thus eliminating 
differences in potential (voltage levels) and balancing the load. During a current fault, 
the USOS EPS utilizes the entire conductive metal structure of the USOS as an 
electrical return to which neutral electrical lines are grounded. The ISS structure will not 
be used as a return at any time unless a fault is present. 

Grounding straps (see Figure 2-44) connect the neutral side of an electrical power 
generator and any power converters, such as a DDCU, to the metal boxes that contain 
them. The grounding straps are physically placed as close as possible to the power 
source to maximize shock protection. The chassis and/or structure of all equipment 
associated with a power source must also be grounded or bonded to prevent shock 
hazards. Bonding is the physical contact between two objects that results in electrical 
conductivity. Bonding or grounding the metal boxes to the USOS structure completes a 
grounding path back to that ORUs power source and provides two distinct advantages. 
The ORU, its power source, and structure are now at the same reference potential 
eliminating any differences in potential and possible shock hazards. Second, the 
grounded box provides a current path that aids in identifying electrical shorts. When a 
short occurs in a load and comes into contact with a grounded box, a path of negligible 
resistance is provided back to the load’s power source causing a sharp increase in 
current flow. This will cause a trip within the power circuit, removing power from the 
component and eliminating a hidden shock hazard. 
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Figure 2-44. Grounding strap 

Rack Power Switch 

The RPS is an emergency power shutdown switch for a Lab rack. It can also be used 
to protect the crew during mate/demate operations while maintaining or replacing a rack 
or its ORUs. When the switch is changed to the OFF position, all power feeds to the 
rack are commanded off and the Tier I C&C software blocks all power "ON" commands 
to the rack. This includes crew, ground and software commands. In Figure 2-45, three 
different versions of the RPSs are shown. The first type is for a rack with no smoke 
detector inside the rack, the second is for a rack containing a smoke detector, and the 
third is for a payload rack. The smoke indication led is illuminated in the event the 
smoke detector inside the rack detects smoke. 
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If an RPS has failed, the MCC ground control workaround is to disable the RPS 
monitoring function at the local MDM level. This tells the software to ignore the RPS 
position sensor information as though the switch did not exist. The crew cannot disable 
the RPS MDM Monitoring function from onboard. The workaround for the crew in the 
rare case of a failure that would inadvertently prevent power to flow to the rack is to cut 
one of two wires on the RPS circuit at the location of the RPS. 

Plasma Contactor Unit 

Although the SPG architecture maintains all components of the USOS EPS are at a 
common potential, this potential may not correspond to the surrounding space 
environment. The potential difference between the ISS structure and the plasma 
environment in orbit could be as much as ~1 40 V do during insolation. This difference 
in potential can result in micro-arcing between the space environment and the ISS 
structure, potentially damaging the arrays or thermal coating that covers the ISS. To 
minimize this potential difference, PCUs located on the Z1 truss generate plasma from 
xenon gas and emit a stream of electrons into space. This electron emission results in 
a “grounding-strap” that effectively grounds the ISS to the space environment, 
minimizing the potential difference as well as related hazards to the ISS and crew. 

The emitted gas is nonpropulsive and does not affect EVA. During operations, the 
Hollow Cathode Assembly (HCA), which heats the xenon gas, can reach temperatures 
up to 600° C To protect EVA crewmembers, the PCU HCA is shielded by a screen to 
protect against inadvertent contact. 

2.3.4.2 Interfaces 

The RPS interfaces with the local MDM (LA-1, LA-2, OR LA-3) responsible for control of 
the rack components. 

The PCUs are powered by RPCM Z13B_B and RPCM Z14B_B and controlled by the 
N1-1/2 MDMs. There is no thermal interface to the PCU since they are located on the 
Z1 truss. 
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2 .3 .4.3 Control 

The only system protection functions that are controlled via MDMs are the load shed 
function, the RPS, and the PCU. The load shed function is controlled by the C&C MDM 
upon receiving a request from a lower tier MDM. The RPS position is monitored by the 
C&C software and all commands to close the RPC to the rack will either be blocked or 
allowed depending upon the state of the RPS. 

The PCUs nominally function in a completely autonomous fashion. However, before 
initial operation, both PCUs must run a one-time only conditioning routine This routine 
includes heating of the xenon tank, as well as heating and cooling of the HCA, baking 
out any contaminants that might have been absorbed during delivery to the ISS. While 
in the conditioning mode, the PCU consumes less than 1 1 5 W. In a worst case 
scenario, heating of the xenon tank may take up to 200 hours to complete, depending 
on the pressure and thermal conditions. A more reasonable time estimate is 10 hours. 
The conditioning routine will be done on both PCUs at the same time. After the 
conditioning routine is completed, the PCUs can be activated Nominally, this activation 
includes starting the PCU, conditioning the cathode, stabilizing the xenon tank 
temperature, making adjustments allowing gas feed lines to reach the correct operating 
temperatures, and finally igniting the HCA, all autonomously The PCU will then 
proceed to the nominal ON state in which xenon gas is discharged. The PCU can also 
be placed in a manual mode in which all steps and functions in the startup process are 
manually controlled, including the valves, heaters, etc. Xenon is consumable and is 
expected to support 1 5 to 2 years of continuous operation Presently, the PCU is 
planned to continuously emit xenon gas, even in eclipse where the PCU is not 
necessary. The rationale is that if the xenon flow were to be controlled, it would have to 
be turned on and off over 8000 times, which might shorten the life of the ORU. It was 
also determined that the life of the xenon reserve would be shortened The PCU modes 
and associated power consumption rates are described in Table 2-31 . 
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Table 2-31. PCU modes and power consumption 
after the conditioning routine 


PCU mode 

PCU mode description 

Shutdown State 

Both valves are closed, heater control is disabled, cathode heater is 
off and the anode voltage supply is also off. The PCU will not 
exceed 20 W during this routine 

Standby Routine 

The tank temperature is sampled for 10 minutes. If the temperature 
Is stable, the tank heaters are enabled and valve 1 is opened. 

Once the tank temperature is in range (73.8° to 126.2° F) The 
tube heaters are also enabled and monitored in the same 
temperature range. The PCU will not exceed 1 15 W during this 
routine 

Ignition Routine 

The tank heaters are disabled after they reach their upper limit and 
after a 3-14 minute time delay, valve 2 is opened and the cathode 
heater Is activated. The tube pressure is monitdred until the tube 
pressure exceeds 33.4 psia. At this point, ignition pulses enable 
the HCA anode output. Once the anode current is greater than 
0.5°A, the ignition pulses cease and the anode current is monitored 
again. If there is a constant current output at the anode, the PCU 
disables the cathode heaters, leaves the ignition routine and enters 
the discharge state. If the anode does not show constant current 
after 30 minutes, the cathode heater is disabled and valve 2 is 
closed. The Ignition Failed indicator is set and the PCU returns to 
standby. The PCU will not exceed 290 W during this routine 

Discharge Mode 

The PCU will remain in this mode as long as the anode current is 
greater than 0.5 A if the current falls below 0 5 A, the PCU will 
return to the ignition routine. Presently, the PCU is planned to 
continuously emit xenon gas, even in eclipse where the PCU is not 
necessary. The rationale is that if controlled, the xenon flow would 
have to be turned on and off over 8000 times in 2 years, which 
might shorten the life of the ORU as well as the xenon reserve 
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2.3. 4. 4 Monitoring 

The RPS position is ultimately monitored by the C&C software in order to prevent 

inadvertent powering of a disabled rack. 

The following data is provided on the PCU: 

• Plasma current 

• Anode voltage 

• Cathode heater voltage 

• Tank and tube temperature 

• Tank and tube pressure 

The PCU has FDIR that will react to failures in the following manner: 

a. For loss of discharge or low discharge, the low discharge indicator is set to the 
active state and the PCU modes to the ignition routine. 

b If the PCU does not reach the discharge state 30 minutes after entering the Ignition 
routine, the ignition-failed indicator is set and the PCU modes to the Standby state. 

c. For low temperature or low tube pressure, the appropriate indicator is set to the 
active state and the PCU modes to the standby state. 

d. Other indicators that are set during a fault are high tank pressure, low anode 
voltage, and heater stuck on. 
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2.3. 4.5 Replacement/Location 

Of the system protection devices, the PCU is the only replaceable component on-orbit. 
Upon depletion of the xenon gas tank assembly, the ORU is returned to the ground for 
replenishment, and then reflown Figure 2-46 shows the location of the PCUs on the 
Z1 truss. 


Note: If an RPS fails, the entire rack will need to be replaced. 



Figure 2-46. Plasma contactor units on the Z1 truss 
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Appendix I. International Space Station (ISS) Plasma Contactor 
Unit (PCU) Utilization Plan Assessment Update: Key Points 

Summary 


International Space Station (ISS) 
Plasma Contactor Unit (PCU) 
Utilization Plan Assessment Update 

TI-13-00869 

Key points summary 
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Assessment Request 


Assess the following possible additions to 
the PCU utilization plan: 

NESC response: 

Nominally leavingthe PCUs off during EVA 
if pre-EVA hazard severity measurements 
and short-term ionospheric environment 
forecasts support that decision. 

NESCTeam recommends operatingtwo 
PCUs during all EVAs as most reliableand 
low cost to provide secure control of ISS 
potentials. This counts as two controls of 
three for two-fault failure control. 

Disablingthe EVA shunt fault detection, NESCTeam recommends to not use FDIR at 

isolation and recovery (FDIR) logic and the anytime during any EVA as it has fault 
supporting operational hazard controls if condition paths that can be more 

two PCUs are in discharge duringthe EVA. hazardousthan the protection it may 

provide. 

Possible long-term marginalization ofthe 
ISS EVA-312 shock hazard report so that no 
active hazard controls are required. 

NESCTeam recommends (again) usingtwo 
PCUs during EVAs ratherthan using no 
active hazard controls. The space plasma 
environment can change under certain 
situations making somewhat hazardous 
conditions occur more quickly than a 
response can be provided to reduce those 
hazardous conditions. 


NESC Request No.: TI-13-00869 







NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

13-00869 

Version: 

1.0 

Title: 

ISS PCU Utilization Plan Assessment Update 

Page #: 

212 of 225 


Main Conclusion of NESC Team 

• NESC team disagrees with replacing PCU active hazard control 
which safely and reliably controls EVA negative arcing hazard 
with a "forecasting" process that has only been evaluated on 
a cursory level, is incapable of predicting the full range of 
observed charging behavior on ISS, and uses tools that do not 
meet NASA standards for making critical decisions. 

- NESC team asserts PCUs should be used regardless of pre EVA 
"predictions" or planned EVA location 


NESC Request No.: TI-13-00869 



NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

13-00869 

Version: 

1.0 

Title: 

ISS PCU Utilization Plan Assessment Update 

Page #: 

213 of 225 


Primary Area of Disagreement#! 


Subject ISS 

NESC Position 

"Forecast" • "Short-term" forecast 

• Potentials more negative than 

Adequacy methodology exists to 

-45V have been measured on 

conduct plasma assessment 

ISS. The ionosphere forecast and 

14 days in advance of EVA 

PIM3.0 models are not capable 

• "Short-term" forecast in- 

of predicting these large 

place and has been used 

potentials 

successfully to support 

• "Forecasting" process (1) has 

Program operational 

only been evaluated on a 

decisions. 

cursory level, (2) is incapable of 

• Low Solar cycle supports 

predictingthe full range of 

usingthis analytical 

observed charging behavioron 

prediction to determine if 

ISS and (3) uses tools that do not 

hazard exists and 

meet NASA standards for making 

determine if controls are 

critical decisions 

needed 


Reference: ISS-NCR-232G and 


2013-10-01-SSPCB-Plasma- 


NCR-ISS-232 final.pdf 


presented to SSPCB 


10/1/2013 
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Primary Area of Disagreement #2 


Subject 

ISS 

NESC Position 

PCU Utilization 

• Use is optional if space 

• Use PCU for all EVAs regardless 


weather forecast calculates 

of pre-EVA severity predictions 


within limit floating 

or EVA location 


potential prediction 

• PCUs can safely and reliably 


• Due to positive potential 

control EVA negative arcing 


hazard PCUs will not be 

hazard for the life of ISS 


used for EVAs outboard of 

• Positive potential hazard 


the SARJs 

concern with running PCUs is 
unwarranted as demonstrated 


Reference: ISS-NCR-232G and 

by calculations in the report (see 


2013-10-01-SSPCB-Plasma- 

next page; higher fidelity model 


NCR-ISS-232 final.pdf 

and verified by FPMU 


presented to SSPCB 

measurements) 


10/1/2013 

• PCU capability to control 
negative hazard much more 
certain than the analytical 
approach's ability to predict the 
hazard 
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Primary Area of Disagreement #3 


Subject 

ISS 

NESC Position 

Positive Charging 

• "Placingthe PCU in 

• NESC team calculations 

Hazard 

discharge produces positive 

(provided in the report) suggest 


potential hazard in +10 to 

overly conservative treatment by 


+12 V range outboard of 

ISS team that overstates the 


SARJ (i.e., catastrophic 

severity of the current available 


hazard)" 

from this "positive hazard". 


• "Positive potential hazard 

• EMU "positive shock hazard" is 


results from placing PCUs in 

the result of making unrealistic 


discharge to prevent 

assumptions about plasma 


negative potential hazard. 

collectionthat model the EMU 


However, negative 

as a bare metal sphere floating 


potentialswithin allowable 

in space connected with a wire 


range with PCUs not in 

to the ISS chassis ground, then 


discharge. Negative levels 

claim that the actual 


driven by solar array 

configuration of the "EMU 


orientation" 

cannot be used as a hazard 


Reference: ISS-NCR-2326 and 

control" for this contrived 


2013-10-01-SSPCB-Plasma- 
NCR-ISS-232 final.pdf 
presented to SSPCB 
10/1/2013 

"hazard". 
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Secondary issues 


Subject 

ISS 

NESC 

Array Shunt FDIR 

• Do not use if space 

• Do not use at all as potentially 

utilization 

weather forecast calculates 

creates larger risk 


within limit floating 

• The effects on the floating 


potential 

potential of unshuntingan array 


• Use (along with PCUs) 

not pointed into ram have not 


when the calculated 

been characterized. 


floating potential is out of 

• Unshunting an array pair 


limit. 

pointed in the ram directions 


• Shunt FDIR invoked upon 

during insolation cancause high 


sensing single PCU failure 

negative peaks (short duration) 


• All 8 solar arrays are 

• Evaluate using additional 


shunted 

isolation features of the EMU 


• FR B9-908 governs 

recovery of an array pair 

along with the low probability of 


after shunt event 

completingthe circuit as the 


Reference: ISS-NCR-232G and 

third control 


2013-10-01-SSPCB-Plasma- 

• Some question on how many 


NCR-ISS-232 final.pdf 

arrays are shunted with FDIR but 


presented to SSPCB 

no bearingon conclusions either 


10/1/2013 

way 
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Secondary issues 

Subject 

ISS 

NESC 

EMU 

• "The EMU is not designed 

• Evaluate what it would take to 


or certified to insulate 

use the EMU's insulative 


against electric shock per 

aspects as a hazard control. 


HR EMU-018." 

• Consider isolation features 


Reference: ISS-NCR-232G 

added to the MMWS. 
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Secondary issues 


Subject 

ISS 

NESC 

Rapid Charging 

• Low likelihood of a shock 

• Noted several instances of RCE 

Events (RCEs) 

hazard due to the short 

data being left off of data plots 


duration nature of RCEs (<5 

presented to ISS management 


seconds) 

- should present all the data 
with explanations 

• The hazards presented by 
these events are not well 
understood 

• No technical argument 
presented to assessment team 
that supports ignoring RCEs 

• PIM3.0 model does not contain 
the physics to predict these 
events 
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Secondary issues 


Subject ISS 

NESC 

Space Environment • Soiarcycles indicate benign 

• The space environment is not 

Persistence environmentthrough Solar 

predictable over short or long 

Cycle 25 (~2030) 

term (ex: future solar activity) so 

• FPMU data since 2007 

cannot assume continued 

corroborates benign 

benign environment 

environment 

• The FPMU database only 

• "FPMU measurements since 

captures ~6% of the total ISS 

2007 have indicated no ISS 

eclipse exit charging events since 

charging in excess of -45V" 

regular operations started in 

(NCR-ISS-232G p.6) 

2007. 

• Not directly used in 

• FPMU measurements since 2007 

prediction calculation so 

document examples of charging 

what is the NESC concern 

more negative than -45 V. 

• Predicted benign 

• Significant space weather events 

environmentand lack of 

still occur during "benign" 

charging in excess of -45V 

environment periods, they just 

used extensively as rationale 

occur less often. 

in persuadingISS 


community to adopt 


forecast approach in NCR 


and SSPCB briefings. 
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Secondary issues 


Subject 

ISS 

NESC 

Ionosphere State 

• Does not vary significantly 

• Affected by a number of factors 


over a period of a few 

such as geomagnetic activity 


weeks 

and auroral charging 


• Corroborated by FPMU 

• Can change rapidly 


data 

• Impact of storm time density 


• Monitored daily until EVA 

depletionsand plasma heating 
on forecast has not been 
evaluated. 

• Daily monitoringuntil EVA has 
been recommended by the 
NESC team but is an unoffical 
(not in release documentation) 
process that is not described in 
ISS NCR and Hazard reports 
which only list a "up to" 14 day 
forecast and hazard 
assessment. 
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Secondary issues 


Subject 

ISS 

NESC 

ISS Charging 

• Uses FPMU measurements 

• Model has too many limitations 

Modeling(PIM3.0) 

to determine whatIRI 

to be predictive of a hazard 


model input to use. 

condition 


• Valid prediction model 

• Model is incapableof 


with some limited, 

predictingthe large transient 


understood shortcomings 

charging events in excess of -45 


• A suitable tool for this 

V observed on ISS (RCEs) 


decision makingflow 

• The hazards presented by 
these events are not well 
understood. 

• Does not meet NASA standards 
for critical models 

• Climatology Inputs are not 
adequateto predict step 
function changes 

• Using the IRI model as 
environmentinputto PIM3.0 is 
inadequatefor short term 
changes 
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Secondary issues 


Subject ISS 


Auroral Charging • Agree, looking into 

inclusion 


NESC 


Not considered in PIM3.0 
model and can be unlikelyyet 
potentially significant charging 
source 

IRI model does not provide 
auroral charging environments 
FPMU documents auroral 
charging on a number of 
occasions but only frame 
charging, no data on surface 
charging. 
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Secondary issues 


Subject 

ISS 

NESC 

Negative Potential 

• -45.5 V approved in Jan 

• -40 V should be maintained 

Limit 

2009 by SRP 

until further experimentation 
• The full range of measured ISS 


Reference: ISS-NCR-232G 

charging events were not 
presented to the SRP. The 
PIM3.0 model accuracy was 
overstated - implied error was 
0 %. 

• The -40V limit associated with 
vehicle charging 

• No voltage limit found for the 
EMU 
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Appendix J. EMU Team Email 


From: "Boyle, Robert M. (JSC-EC511)" < robert.m.bovle@nasa.gov > 

Date: June 13, 2014 at 5:08:18 PM CDT 

To: "Hansen, Christopher P. (JSC-EC1 1 1)" < christopher.p .hansen@nasa.gov >, "Blanco, Raul A. 
(JSC-EC51 1)" < raul.a.blanco@nasa.gov > 

Cc: "West, T. Scott (JSC-C105)" < timothy, s ,west@nasa. gov > 

Subject: RE: EMU/plasma shock hazard 

I agree with conclusions in the executive summary and the recommendations in section 8. I reviewed 
sections 7.9 - 7.13 in detail, and had the following minor comments. They can be ignored if desired, it 
will not change the report conclusions. 

In Table 7.9-1 the Body Seal Closure/MMWS Connection coating is noted as anodize. The parts are 
Stainless Steel. There is a caveat noting the coating data is suspect and not used in the calculations. 

In Table 7.9-1 1 don't understand why the DCM and OBS are lumped in one row. Totally different 
hardware. 

The baseplate and MWS probably protect the SS bosses (MMWS Connection) from contacting the 
tether, but the statement that the baseplate is isolated seems to ignore the exposed SS. 

It was a very educational read. Thanks. Good job. 

Rob 

From: Hansen, Christopher P. (J SC- ECU 1 ) 

Sent: Tuesday, J une 03, 2014 4:06 PM 

To: Boyle, Robert M. (J SC-EC511); Blanco, Raul A. (J SC-EC511) 

Subject: FW: EMU/plasma shock hazard 

Here's the NESC report on the PCU hazard. Scott West (NESC Chief Engineer for JSC) asked that we take 
a look at the EMU sections and let him know if we agree with them. 

Chris 


From: West, T. Scott (J SC-C105) 

Sent: T uesday, J une 03, 2014 10:19 AM 
To: Hansen, Christopher P. (JSC-EC111) 

Subject: RE: EMU/plasma shock hazard 

Thanks Chris. I've enclosed the whole draft report, but sections 7.9 - 7.13 are the main sections to look 
at for the EMU in relation to the shock hazard. The appendices are also there with the EMU information 
that was presented to the assessment team that they used to do their analysis. And yes this was being 
looked at relative to running/not running PCUs and also enabling or not enabling the shunt FDIR. The 
first part of the report should help provide some context. 
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A reply from team member Ira Katz to the below Rob Boyle comment. 

The baseplate and MWS probably protect the SS bosses (MMWS Connection) from contacting the 
tether, but the statement that the baseplate is isolated seems to ignore the exposed SS. 

From: Katz, Ira (353B) [mailto:ira.katz@jpl.nasa.gov] 

Sent: Tuesday, J une 17, 2014 11:47 AM 

To: Hernandez-Pelle, Amri I. (GSFC-5630); Schneider, Todd A. (MSFC-EM50); Moran, Erin (LARC- 
C101)[TEAMS2] 

Subject: RE: REPORT FINAL COMMENTS 
Amri- 

I looked through the 2 suit presentations "Baseplate_-_BRT_Continuity_Test_Summary(l)" and 
"NESC_ISS_Shock_EVA_Actions" and the best I can interpret Rob Boyles comments are that there is 
some exposed stainless steel that actually can contact some of the metal, either anodized aluminum or 
stainless steel, inside the suit. Flowever, they have a very small area, so they wouldn't have a big effect 
on either the probability or current collection calculations. I think this metal was included in the Boeing 
PRA. Rob Boyles's conclusion ""The baseplate and MWS probably protect the SS bosses (MMWS 
Connection) from contacting the tether,..." is basically our conclusion. I'd have to review the physical 
hardware with him in person if you need a better answer. I'm afraid this is the best I can do with emails 
and PowerPoint presentations. 

Thanks - ira 


NESC Request No.: TI-13-00869 


REPORT DOCUMENTATION PAGE 


Form Approved 
OMB No. 0704-0188 


The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, 
gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this 
collection of information, including suggestions for reducing this burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and 
Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person 
shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. 

PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS. 


1. REPORT DATE (DD-MM-YYYY) 
01-08 - 2014 


2. REPORT TYPE 

Technical Memorandum 


3. DATES COVERED (From - To) 
May 2013 - July 2014 


4. TITLE AND SUBTITLE 


International Space Station (ISS) Plasma Contactor Unit (PCU) Utilization 
Plan Assessment Update 


5a. CONTRACT NUMBER 


5b. GRANT NUMBER 


5c. PROGRAM ELEMENT NUMBER 


6. AUTHOR(S) 

Hernandez-Pellerano, Amri; Iannello, Christopher J.; Garrett, Henry B.; 
Ging, Andrew T.; Katz, Ira; Keith, R. Lloyd; Minow, Joseph I.; 

Willis, Emily M.; Schneider, Todd A.; Whittlesey, Albert C.; 

Wollack, Edward J.; Wright, Keneth H. 


5d. PROJECT NUMBER 


5e. TASK NUMBER 


5f. WORK UNIT NUMBER 

869021.05.07.09.37 


7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 

NASA Langley Research Center 
Hampton, VA 23681-2199 


8. PERFORMING ORGANIZATION 
REPORT NUMBER 


L-20454 NESC-RP- 13-00869 


9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES) 

National Aeronautics and Space Administration 
Washington, DC 20546-0001 


10. SPONSOR/MONITOR'S ACRONYM(S) 

NASA 


11. SPONSOR/MONITOR'S REPORT 
NUMBER(S) 

NASA/TM-20 14-2 185 12 


12. DISTRIBUTION/AVAILABILITY STATEMENT 

Unclassified - Unlimited 

Subject Category 16 - Space Transportation and Safety 
Availability: NASA CAS1 (443) 757-5802 


13. SUPPLEMENTARY NOTES 


14. ABSTRACT 


The NASA Engineering and Safety Center (NESC) received a request to support the Assessment of the International Space 
Station (ISS) Plasma Contactor Unit (PCU) Utilization Update. The NESC conducted an earlier assessment of the use of the 
PCU in 2009. This document contains the outcome of the assessment update. 


15. SUBJECT TERMS 

International Space Station; Extravehicular activity; NASA Engineering and Safety Center; Plasma Contactor Unit; 
Extravehicular Mobility Unit 


16. SECURITY CLASSIFICATION OF: 

17. LIMITATION OF 
ABSTRACT 

18. NUMBER 
OF 

19a. NAME OF RESPONSIBLE PERSON 

a. REPORT 

b. ABSTRACT 

c. THIS PAGE 

PAGES 

STI Help Desk (email: help@sti.nasa.gov) 






19b. TELEPHONE NUMBER (Include area code) 

u 

u 

u 

uu 

230 

(443) 757-5802 


Standard Form 298 (Rev. 8-98) 

Prescribed by ANSI Std. Z39.18 


